Neo4j vulnerabilities and fixes

CVEs that mention Neo4j, ranked by priority. 2 tracked.

Neo4j has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-08-18. Highest priority: CVE-2026-5423 (score 46/100).

• CVE-2026-5423 HIGH 8.2 @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decod
• CVE-2026-19869 HIGH 7.6 @neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on roo

FAQ

How do I fix Neo4j vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Neo4j being exploited right now?

None of the tracked Neo4j CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Neo4j CVE should I patch first?

CVE-2026-5423 currently ranks highest (46/100): @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decod.

← Back to latest CVEs