CVE-2026-22743: Spring AI Neo4j Cypher Injection Vulnerability

CVE-2026-22743 Overview

CVE-2026-22743 is a Cypher injection vulnerability in Spring AI's spring-ai-neo4j-store component. The vulnerability exists in Neo4jVectorFilterExpressionConverter, where user-controlled strings passed as filter expression keys are improperly handled. Specifically, the doKey() method embeds user input into a backtick-delimited Cypher property accessor (node.\metadata.``) after only stripping double quotes, without properly escaping embedded backticks. This allows attackers to break out of the intended property accessor context and inject arbitrary Cypher queries.

Critical Impact

Attackers can exploit this Cypher injection vulnerability to extract sensitive data from the Neo4j database, bypass security controls, or manipulate query logic through maliciously crafted filter expression keys.

Affected Products

• Spring AI versions from 1.0.0 to before 1.0.5
• Spring AI versions from 1.1.0 to before 1.1.4
• Applications using spring-ai-neo4j-store with user-controlled filter expressions

Discovery Timeline

• 2026-03-27 - CVE-2026-22743 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-22743

Vulnerability Analysis

This Cypher injection vulnerability (CWE-89) arises from insufficient input sanitization in the Neo4jVectorFilterExpressionConverter class. The vulnerability is network-exploitable without requiring authentication or user interaction, making it particularly dangerous in applications that expose filter functionality to untrusted users.

The core issue is that the doKey() method only removes double quotes from user-supplied filter expression keys before embedding them into Cypher queries. However, Cypher uses backticks as delimiters for property accessors, and these are not escaped or stripped. An attacker can include backtick characters in their input to prematurely close the property accessor context and inject arbitrary Cypher statements.

This type of injection can lead to unauthorized data disclosure from the Neo4j database. Applications using Spring AI's Neo4j vector store for AI/ML workloads, RAG (Retrieval-Augmented Generation) systems, or semantic search functionality are at risk if filter expressions are derived from user input.

Root Cause

The root cause is an incomplete input sanitization approach in Neo4jVectorFilterExpressionConverter.doKey(). The method strips double quotes from the filter expression key but fails to escape or remove backtick characters. Since Cypher uses backticks to delimit identifiers containing special characters, an attacker can inject a backtick to escape the intended context and append malicious Cypher code.

Attack Vector

The attack is executed over the network by supplying a maliciously crafted filter expression key to an application using the vulnerable spring-ai-neo4j-store component. The attacker embeds backtick characters in the key value to break out of the backtick-delimited property accessor and inject arbitrary Cypher statements.

For example, if an application accepts a filter key from user input and passes it to Neo4jVectorFilterExpressionConverter, an attacker could supply a key containing backticks followed by Cypher injection payloads. The injected code would then be executed in the context of the Neo4j database query, potentially exposing sensitive data or manipulating query results.

Technical details and proof-of-concept information can be found in the Spring Security Advisory CVE-2026-22743.

Detection Methods for CVE-2026-22743

Indicators of Compromise

• Unusual or malformed filter expression keys containing backtick characters in application logs
• Unexpected query patterns or data access attempts against the Neo4j database
• Error messages or exceptions from Neo4j indicating malformed Cypher queries
• Anomalous data retrieval patterns that don't match expected application behavior

Detection Strategies

• Monitor application logs for filter expression inputs containing backtick (`) characters
• Implement query logging on the Neo4j database to detect injection attempts
• Deploy web application firewalls (WAF) with rules to detect Cypher injection patterns
• Use SentinelOne Singularity to monitor for suspicious process behaviors and network activity indicative of data exfiltration

Monitoring Recommendations

• Enable detailed logging for the spring-ai-neo4j-store component to capture filter expression values
• Configure Neo4j audit logging to track query execution and identify anomalous patterns
• Set up alerting for applications that process user-supplied filter expressions
• Monitor network traffic for large or unusual data transfers from Neo4j database endpoints

How to Mitigate CVE-2026-22743

Immediate Actions Required

• Upgrade Spring AI to version 1.0.5 or later for the 1.0.x branch
• Upgrade Spring AI to version 1.1.4 or later for the 1.1.x branch
• Audit applications to identify all locations where user input is passed to filter expressions
• Implement input validation to reject filter expression keys containing backtick characters

Patch Information

VMware/Spring has released patched versions that address this Cypher injection vulnerability. Organizations should upgrade to Spring AI 1.0.5 or 1.1.4 (or later versions in their respective branches) as soon as possible. Detailed information about the fix is available in the Spring Security Advisory CVE-2026-22743.

Workarounds

• Implement strict input validation on all user-supplied filter expression keys, rejecting any input containing backtick characters
• Use an allowlist approach for filter expression keys, only permitting known-safe values
• Deploy a reverse proxy or WAF with rules to block requests containing Cypher injection patterns
• Restrict database user permissions to limit the impact of potential injection attacks

# Example: Update Spring AI dependency in Maven pom.xml
# For 1.0.x branch:
# <dependency>
#     <groupId>org.springframework.ai</groupId>
#     <artifactId>spring-ai-neo4j-store</artifactId>
#     <version>1.0.5</version>
# </dependency>

# For 1.1.x branch:
# <dependency>
#     <groupId>org.springframework.ai</groupId>
#     <artifactId>spring-ai-neo4j-store</artifactId>
#     <version>1.1.4</version>
# </dependency>