TI-2026-01308 Aliases CVE-2026-1622 GHSA-4j3g-rwwq-4p54

Unredacted data exposure in query.log

LOW 21CWE-532Published 2026-02-04 · Updated 2026-02-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 7 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

Neo4j Enterprise and Community editions versions prior to 2026.01.3 and 5.26.21 are vulnerable to a potential information disclosure by a user who has ability to access the local log files. The "obfuscate_literals" option in the query logs does not redact error information, exposing unredacted data in the query log when a customer writes a query that fails. It can allow a user with legitimate access to the local log files to obtain information they are not authorised to see. If this user is also in a position to run queries and trigger errors, this vulnerability can potentially help them to infer information they are not authorised to see through their intended database access. We recommend upgrading to versions 2026.01.3 (or 5.26.21) where the issue is fixed, and reviewing query log files permissions to ensure restricted access. If your configuration had db.logs.query.obfuscate_literals enabled, and you wish the obfuscation to cover the error messages as well, you need to enable the new configuration setting db.logs.query.obfuscate_errors once you have upgraded Neo4j.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0016 5th percentileScored 2026-11-07

Fix Partial Enterprise Edition (neo4j): 2026.01.3, 5.26.21, 4.4.48Community Edition (neo4j): 2026.01.3, 5.26.21, 4.4.48+1 more productRed Hat: 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
neo4j	Enterprise Edition	2025.01 to before 2026.01.3; 5.0 to before 5.26.21; 4.4 to before 4.4.48	2026.01.3, 5.26.21, 4.4.48	Patch available	CNA
neo4j	Community Edition	2025.01 to before 2026.01.3; 5.0 to before 5.26.21; 4.4 to before 4.4.48	2026.01.3, 5.26.21, 4.4.48	Patch available	CNA
—	org.neo4j:neo4j (Maven)	before 5.26.21	5.26.21	Patch available	GHSA-4j3g-rwwq-4p54
—	org.neo4j:neo4j (Maven)	2025.01.0 to before 2026.01.3	2026.01.3	Patch available	GHSA-4j3g-rwwq-4p54

Enterprise Edition Vendorneo4j Affected 2025.01 to before 2026.01.3; 5.0 to before 5.26.21; 4.4 to before 4.4.48 Fixed in 2026.01.3, 5.26.21, 4.4.48 Patch available CNA
Community Edition Vendorneo4j Affected 2025.01 to before 2026.01.3; 5.0 to before 5.26.21; 4.4 to before 4.4.48 Fixed in 2026.01.3, 5.26.21, 4.4.48 Patch available CNA
org.neo4j:neo4j (Maven) Vendor— Affected before 5.26.21 Fixed in 5.26.21 Patch available GHSA-4j3g-rwwq-4p54
org.neo4j:neo4j (Maven) Vendor— Affected 2025.01.0 to before 2026.01.3 Fixed in 2026.01.3 Patch available GHSA-4j3g-rwwq-4p54

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:neo4j:neo4j::::::::	—	—	neo4j

cpe:2.3:a:neo4j:neo4j:*:*:*:*:*:*:*:* Versions — — ·neo4j

Remediation

Fix · CNA Enterprise Edition (neo4j) Fixed in 2026.01.3, 5.26.21, 4.4.48
Fix · CNA Community Edition (neo4j) Fixed in 2026.01.3, 5.26.21, 4.4.48
Fix · GHSA-4j3g-rwwq-4p54 org.neo4j:neo4j (Maven) Fixed in 5.26.21 Advisory →
Fix · GHSA-4j3g-rwwq-4p54 org.neo4j:neo4j (Maven) Fixed in 2026.01.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Fuse 7	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 8	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat OpenShift Dev Spaces	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-1622
2026-10-03 Alias added: GHSA-4j3g-rwwq-4p54

References

Advisory 2

Other 1

https://github.com/neo4j/neo4j

TI-2021-13406 Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that… CVSS 3.1CRITICAL 9.8
TI-2026-71015 Authentication ignored for top-level @cypher fields in @neo4j/graphql CVSS 4.0CRITICAL 9.3
TI-2018-16042 neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External… CVSS 3.0CRITICAL 10.0
TI-2018-13005 Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9… CVSS 3.0CRITICAL 9.8
TI-2021-18971 A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before… CVSS 3.1CRITICAL 9.1
TI-2026-01049 Insufficient escaping of unicode characters in query log CVSS 4.0LOW 1.1

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences