CVE-2026-46591

{
  "id": "CVE-2026-46591",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-06T09:16:37.263",
  "lastModified": "2026-10-25T15:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component.\n\nThe camel-neo4j producer builds the Cypher WHERE clause for its match/retrieve and delete operations from the CamelNeo4jMatchProperties map. CVE-2025-66169 addressed Cypher injection through the property values by binding them as query parameters ($paramN), but the property names (the JSON keys of that map) were still concatenated into the query string verbatim in Neo4jProducer.retrieveNodes() and deleteNode(). A property name containing Cypher syntax therefore alters the structure of the executed query. Where a route maps untrusted input into the CamelNeo4jMatchProperties map - for example by passing a request body as the match map, or from a consumer that does not filter inbound Camel* headers - an attacker who controls the JSON key names can inject arbitrary Cypher and read, modify or delete any node or relationship in the Neo4j database. The CamelNeo4jMatchProperties header is itself Camel-prefixed and is filtered by the HTTP header-filter strategy, so a plain HTTP client cannot set it directly; the issue is reachable through routes that deliberately or inadvertently carry untrusted data into that header.\nThis issue affects Apache Camel: from 4.10.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nUsers are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, do not populate the CamelNeo4jMatchProperties map from untrusted input: validate or allow-list the property names (for example against ^[A-Za-z_][A-Za-z0-9_]*$) before the Neo4j producer, and ensure that any consumer feeding such a route filters inbound Camel* / camel* headers so the match header cannot be supplied by an external sender."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Neutralización Incorrecta de Elementos Especiales en la Lógica de Consulta de Datos en el componente Apache Camel Neo4J.\n\nEl productor camel-neo4j construye la cláusula WHERE de Cypher para sus operaciones de coincidencia/recuperación y eliminación a partir del mapa CamelNeo4jMatchProperties. CVE-2025-66169 abordó la inyección de Cypher a través de los valores de las propiedades al vincularlos como parámetros de consulta ($paramN), pero los nombres de las propiedades (las claves JSON de ese mapa) aún se concatenaban en la cadena de consulta textualmente en Neo4jProducer.retrieveNodes() y deleteNode(). Un nombre de propiedad que contiene sintaxis Cypher, por lo tanto, altera la estructura de la consulta ejecutada. Donde una ruta mapea entrada no confiable en el mapa CamelNeo4jMatchProperties - por ejemplo, pasando un cuerpo de solicitud como el mapa de coincidencia, o desde un consumidor que no filtra los encabezados Camel entrantes - un atacante que controla los nombres de las claves JSON puede inyectar Cypher arbitrario y leer, modificar o eliminar cualquier nodo o relación en la base de datos Neo4j. El encabezado CamelNeo4jMatchProperties tiene prefijo Camel y es filtrado por la estrategia de filtro de encabezados HTTP, por lo que un cliente HTTP simple no puede establecerlo directamente; el problema es alcanzable a través de rutas que deliberada o inadvertidamente llevan datos no confiables a ese encabezado.\nEste problema afecta a Apache Camel: desde 4.10.0 antes de 4.14.8, desde 4.15.0 antes de 4.18.3, desde 4.19.0 antes de 4.21.0.\n\nSe recomienda a los usuarios actualizar a la versión 4.21.0, que corrige el problema. Si los usuarios están en la rama de lanzamientos LTS 4.14.x, entonces se sugiere que actualicen a 4.14.8. Si los usuarios están en la rama de lanzamientos 4.18.x, entonces se sugiere que actualicen a 4.18.3. Para implementaciones que no pueden actualizarse inmediatamente, no rellene el mapa CamelNeo4jMatchProperties con entrada no confiable: valide o incluya en una lista blanca los nombres de las propiedades (por ejemplo, contra ^[A-Za-z_][A-Za-z0-9_]*$) antes del productor Neo4j, y asegúrese de que cualquier consumidor que alimente dicha ruta filtre los encabezados Camel / camel entrantes para que el encabezado de coincidencia no pueda ser proporcionado por un remitente externo."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Camel",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.camel:camel-neo4j",
          "versions": [
            {
              "version": "4.10.0",
              "lessThan": "4.14.8",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.15.0",
              "lessThan": "4.18.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.19.0",
              "lessThan": "4.21.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-06T19:20:49.095923Z",
          "id": "CVE-2026-46591",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-943"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.10.0",
              "versionEndExcluding": "4.14.8",
              "matchCriteriaId": "CD453DD1-65B8-49D0-BB84-3D585163C326"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.15.0",
              "versionEndExcluding": "4.18.3",
              "matchCriteriaId": "0AEE4159-4465-4ACD-B94A-1E4682C85270"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.19.0",
              "versionEndExcluding": "4.21.0",
              "matchCriteriaId": "1C2A1A7A-FADC-470F-8265-FA126AFD94ED"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://camel.apache.org/security/CVE-2026-46591.html",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}