CVE-2025-66169: Apache Camel SQLi Vulnerability

CVE-2025-66169 Overview

A Cypher Injection vulnerability has been identified in the Apache Camel camel-neo4j component. This security flaw allows attackers to inject malicious Cypher queries into Neo4j database operations through the Apache Camel integration framework. Cypher is Neo4j's graph query language, and injection vulnerabilities in this context can allow unauthorized data manipulation or extraction from the underlying graph database.

This vulnerability affects Apache Camel versions from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, and from 4.15.0 before 4.17.0. Organizations using the camel-neo4j component for Neo4j database integrations should prioritize upgrading to patched versions.

Critical Impact

Attackers can exploit this Cypher Injection vulnerability to manipulate Neo4j database queries, potentially leading to unauthorized data modification within graph databases connected via the camel-neo4j component.

Affected Products

• Apache Camel versions 4.10.0 to 4.10.7 (fixed in 4.10.8)
• Apache Camel versions 4.14.0 to 4.14.2 (fixed in 4.14.3)
• Apache Camel versions 4.15.0 to 4.16.x (fixed in 4.17.0)

Discovery Timeline

• January 14, 2026 - CVE-2025-66169 published to NVD
• January 16, 2026 - Last updated in NVD database

Technical Details for CVE-2025-66169

Vulnerability Analysis

This vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), which in this context applies to Cypher query injection. The camel-neo4j component fails to properly sanitize user-supplied input before incorporating it into Cypher queries executed against Neo4j databases.

Cypher Injection is analogous to SQL Injection but targets Neo4j's graph query language. When user-controlled data is concatenated directly into Cypher query strings without proper parameterization or escaping, attackers can manipulate the query structure to perform unauthorized operations.

The vulnerability is exploitable over the network without requiring authentication or user interaction. While the impact is limited to data integrity (unauthorized modifications), the accessibility of the attack vector makes this a notable security concern for applications using the affected component.

Root Cause

The root cause lies in insufficient input validation and lack of proper query parameterization within the camel-neo4j component. When handling Cypher queries, the component appears to directly interpolate untrusted input into query strings rather than using Neo4j's built-in parameterized query mechanisms. This architectural weakness allows attackers to escape the intended query context and inject arbitrary Cypher statements.

Attack Vector

The attack vector is network-based, requiring no privileges or user interaction. An attacker can exploit this vulnerability by sending specially crafted input to an application endpoint that processes data through the vulnerable camel-neo4j component. The malicious input, when incorporated into a Cypher query, can alter the query's logic or append additional commands.

For example, if an application builds a Cypher query using user-supplied node identifiers or property values without proper sanitization, an attacker could inject Cypher syntax to bypass intended query restrictions, extract additional data, or modify graph relationships. For detailed technical analysis, see the Apache Camel CVE-2025-66169 Advisory.

Detection Methods for CVE-2025-66169

Indicators of Compromise

• Unusual or malformed Cypher query patterns in Neo4j database logs containing unexpected syntax elements
• Application logs showing Neo4j query errors or exceptions that suggest query manipulation attempts
• Unexpected data modifications in Neo4j graph databases without corresponding legitimate application activity
• Network traffic containing suspicious payloads with Cypher injection patterns targeting endpoints using camel-neo4j

Detection Strategies

• Implement query logging on Neo4j databases to capture and analyze all executed Cypher queries for anomalous patterns
• Deploy Web Application Firewall (WAF) rules to detect common injection patterns in requests to endpoints utilizing camel-neo4j
• Enable Apache Camel logging at DEBUG level for the neo4j component to capture query construction details
• Utilize SentinelOne Singularity XDR to monitor application behavior and detect exploitation attempts through behavioral analysis

Monitoring Recommendations

• Configure alerts for Neo4j query execution failures that may indicate injection attempts
• Monitor for changes to graph database structure or unexpected relationship modifications
• Implement application performance monitoring to detect abnormal query execution times that could signal exploitation
• Review audit logs for unauthorized data access patterns in systems using the camel-neo4j component

How to Mitigate CVE-2025-66169

Immediate Actions Required

• Upgrade Apache Camel to patched versions: 4.10.8 for 4.10.x LTS, 4.14.3 for 4.14.x LTS, or 4.17.0 for newer versions
• Audit all applications using the camel-neo4j component to identify vulnerable deployments
• Review and restrict network access to Neo4j databases to limit exposure during the upgrade process
• Implement input validation at the application layer as a defense-in-depth measure

Patch Information

Apache has released security patches addressing this vulnerability. Users are strongly recommended to upgrade to the following versions:

• 4.10.x LTS users: Upgrade to version 4.10.8
• 4.14.x LTS users: Upgrade to version 4.14.3
• 4.15.x and newer users: Upgrade to version 4.17.0

For complete patch details and upgrade instructions, refer to the Apache Camel CVE-2025-66169 Advisory. Additional context is available in the Openwall OSS-Security Mailing List Post.

Workarounds

• Implement strict input validation to sanitize all user-supplied data before it reaches the camel-neo4j component
• Use parameterized Cypher queries at the application level where possible to prevent injection
• Restrict Neo4j database user permissions to minimize the impact of successful injection attacks
• Consider temporarily disabling or isolating functionality that relies on the camel-neo4j component until patches can be applied

# Example: Verify Apache Camel version in Maven project
mvn dependency:tree | grep camel-neo4j

# Update camel-neo4j dependency in pom.xml to patched version
# For 4.10.x LTS:
# <version>4.10.8</version>
# For 4.14.x LTS:
# <version>4.14.3</version>
# For latest:
# <version>4.17.0</version>