Neo4j @neo4j/graphql: Authentication bypass via aggregation queries
Summary
The Neo4j GraphQL library for Node.js does not enforce field-level @authentication on string aggregates, and connection-root aggregates skip the entity's AGGREGATE authentication requirement. A remote attacker can therefore read protected data through GraphQL aggregation queries without authentication, provided the API is reachable and exposes such aggregations. The CVSS vector rates confidentiality impact as high and requires no privileges or user interaction.
Affected
- @neo4j/graphql 5.0.0 before 5.12.17
- @neo4j/graphql 7.0.0 before 7.6.8
- Version ranges taken from the CVE record and the vendor advisory; the advisory itself could not be independently verified.
Fixed in
- Upgrade to 5.12.17 (LTS line) or 7.6.8 (latest).
Workaround
- Restrict access to aggregate queries over protected data until the upgrade is applied.
- Restrict unauthenticated access to the GraphQL endpoint at the reverse proxy or API gateway (interim measure, not vendor-sourced; verify it works in your setup).
Exploitation
Unknown. No evidence of in-the-wild exploitation, public proof of concept or CISA KEV listing was found at the time of research.
Our recommendation
- Check whether any application uses @neo4j/graphql (for example with npm ls @neo4j/graphql) and which version.
- Upgrade to 5.12.17 or 7.6.8 as soon as possible.
- Verify whether the GraphQL API is internet-facing and whether aggregation fields expose sensitive data.
- Review @authentication rules on connection-root aggregates and string fields.
- Re-check this entry once NVD analysis is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-9r8x-hf5g-rh66 github.com
- Neo4j GraphQL security overview github.com
- npm package @neo4j/graphql www.npmjs.com
- Neo4j GraphQL securing a GraphQL API neo4j.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 18:23.
Original description (NVD)
Missing Authentication for Critical Function in aggregation queries in Neo4j @neo4j/graphql 5.0.0 before 5.12.17 and 7.0.0 before 7.6.8 allows remote attackers to read protected data via GraphQL aggregation queries. Field-level @authentication is not enforced on string aggregates, which can return stored values verbatim, and connection-root aggregates bypass an entity's AGGREGATE authentication requirement, allowing unauthenticated callers to obtain aggregate results.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.