CVE-2026-1497: Incorrect privilege assignment in composite databases
Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any local database or remote alias called "name". If such database or alias doesn't exist when the command is run, the privileges will apply if it's created in the future.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1497?
CVE-2026-1497 carries a significant severity due to incorrect privilege assignments that can expose sensitive data.
How do I fix CVE-2026-1497?
To remediate CVE-2026-1497, upgrade your Neo4j Enterprise edition to version 2026.02 or 5.26.22 or later.
What are the risks associated with CVE-2026-1497?
The risks include unauthorized access to remote database components due to improper namespace resolution.
Who is affected by CVE-2026-1497?
CVE-2026-1497 affects users of Neo4j Enterprise edition versions prior to 2026.02 and 5.26.22.
What types of databases are impacted by CVE-2026-1497?
CVE-2026-1497 specifically impacts composite databases within the Neo4j Enterprise edition.