TI-2026-01168 Aliases CVE-2026-1471 GHSA-4g98-g8wp-gw9f

Caching of authentication context

LOW 11CWE-863Published 2026-03-11 · Updated 2026-03-11

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Partial Red Hat: 7 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-863.

Summary

Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint). We recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00283 20th percentileScored 2026-11-07

Fix Partial Enterprise edition (Neo4j): 2026.01.4, 5.26.22Red Hat: 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
neo4j	Enterprise edition	2025.01 to before 2026.01.4; 4.4.0 to before 5.26.22	2026.01.4, 5.26.22	Patch available	CNA

Enterprise edition Vendorneo4j Affected 2025.01 to before 2026.01.4; 4.4.0 to before 5.26.22 Fixed in 2026.01.4, 5.26.22 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:neo4j:neo4j:::::enterprise:::*	before 5.26.22; 2025.01.0 to before 2026.01.4	Vulnerable	neo4j

cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:* Versions before 5.26.22; 2025.01.0 to before 2026.01.4 Vulnerable ·neo4j

Remediation

Fix · CNA Enterprise edition (Neo4j) Fixed in 2026.01.4, 5.26.22

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Fuse 7	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 8	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat OpenShift Dev Spaces	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-1471
2026-10-03 Alias added: GHSA-4g98-g8wp-gw9f

References

Advisory 1

https://neo4j.com/security/CVE-2026-1471

TI-2021-13406 Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that… CVSS 3.1CRITICAL 9.8
TI-2018-13005 Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9… CVSS 3.0CRITICAL 9.8
TI-2026-01049 Insufficient escaping of unicode characters in query log CVSS 4.0LOW 1.1
TI-2013-05927 Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote… CVSS 2.0MEDIUM 6.8
TI-2026-12296 Unathenticated connection can hold Bolt channel open CVSS 4.0MEDIUM 5.5
TI-2024-22827 Improper privilege management in Neo4j CVSS 3.1MEDIUM 6.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences