CVE-2026-55615: Langroid Neo4j RCE Vulnerability

CVE-2026-55615 Overview

CVE-2026-55615 is a prompt injection vulnerability in Langroid, a Python framework for building large-language-model-powered applications. The Neo4jChatAgent component passes LLM-generated Cypher queries directly to the Neo4j driver without validation, statement-type allowlisting, or an opt-out gate. An attacker who can influence the prompt, either through direct user input or indirect content retrieved through Retrieval-Augmented Generation (RAG), can read or destroy graph data. When APOC or dbms.security procedures are enabled on the Neo4j server, the attacker can achieve operating system command execution and filesystem access. The defect mirrors the earlier SQLChatAgent prompt-to-SQL-to-RCE issue (CVE-2026-25879) fixed in version 0.63.0, which did not extend coverage to the neo4j module.

Critical Impact
Prompt injection can escalate to full graph data destruction and, with APOC enabled, operating system command execution on the Neo4j host.

Affected Products

Langroid framework prior to version 0.65.5
Applications using Neo4jChatAgent with connected Neo4j databases
Neo4j deployments with APOC or dbms.security procedures enabled (elevated impact)

Discovery Timeline

2026-07-10 - CVE-2026-55615 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-55615

Vulnerability Analysis

Langroid's Neo4jChatAgent provides an LLM-driven interface to Neo4j graph databases. The agent generates Cypher queries based on user prompts and executes them through the Neo4j driver. The framework applies no validation, no allowlist restricting queries to read-only statement types, and no user consent gate before execution. This classifies the issue under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component, commonly known as injection.

An attacker who controls any content the LLM processes can steer query generation. This includes direct chat input and any documents, web pages, or database rows the agent reads through RAG pipelines. Because Cypher supports write and administrative operations, a crafted prompt can produce MATCH (n) DETACH DELETE n to wipe the graph or invoke CALL apoc.load.json and CALL apoc.export.* procedures.

Root Cause

The root cause is the absence of an execution boundary between the LLM output and the Neo4j driver. Query text produced by a probabilistic model is treated as trusted code. No parameterization, statement-type inspection, or human-in-the-loop confirmation gates the execution path.

Attack Vector

Exploitation requires network access to an application that exposes Neo4jChatAgent. Direct injection works through chat interfaces. Indirect injection works through any RAG source the agent ingests, including documents, HTML, or upstream database content. When the target Neo4j server has APOC installed, procedures such as apoc.cypher.doIt, apoc.load.csv, or apoc.export.csv.query extend the impact from data destruction to filesystem read/write and OS command execution. The security advisory GHSA-2pq5-3q89-j7cc and the remediation commit describe the fix.

Detection Methods for CVE-2026-55615

Indicators of Compromise

Neo4j query logs containing destructive Cypher such as DETACH DELETE, DROP, or REMOVE originating from application service accounts
Invocations of APOC procedures (apoc.load.*, apoc.export.*, apoc.cypher.doIt) from Langroid-backed applications that do not normally use them
Unexpected CALL dbms.security.* procedure calls or newly created database users
Outbound network connections from the Neo4j host to attacker-controlled endpoints after suspicious agent activity

Detection Strategies

Enable Neo4j query logging and alert on write, delete, or CALL statements produced by the agent's service account
Correlate LLM prompt content with generated Cypher queries to flag prompt injection patterns such as instructions to ignore prior context
Baseline the statement types the agent normally emits and alert on deviations to write or administrative operations

Monitoring Recommendations

Ship Neo4j query.log and security.log to a central analytics platform for retention and correlation with application logs
Monitor the Langroid package version in production dependency manifests to confirm >=0.65.5
Track process execution and file writes on the Neo4j host to detect APOC-driven OS command execution

How to Mitigate CVE-2026-55615

Immediate Actions Required

Upgrade Langroid to version 0.65.5 or later, which contains the fix for the neo4j module
Audit all Neo4j databases connected to Langroid agents for unauthorized changes since deployment
Rotate Neo4j credentials used by Langroid applications if exposure is suspected
Disable APOC and dbms.security procedures on Neo4j instances that do not require them

Patch Information

The fix ships in Langroid 0.65.5. Review the remediation commit 5a3097d and the GitHub Security Advisory GHSA-2pq5-3q89-j7cc for details on the added validation and opt-in gate for write queries.

Workarounds

Restrict the Neo4j service account used by Langroid to read-only role privileges until upgrade is possible
Disable APOC procedures and unset dbms.security.procedures.unrestricted on the Neo4j server
Isolate Neo4jChatAgent deployments behind authenticated interfaces and sanitize RAG source content to reduce indirect prompt injection surface
Implement a human confirmation step before executing any Cypher query that modifies data

bash

# Upgrade Langroid to the patched release
pip install --upgrade 'langroid>=0.65.5'

# Verify installed version
python -c "import langroid; print(langroid.__version__)"

# Restrict the Neo4j role used by the agent (run in cypher-shell as admin)
# GRANT ROLE reader TO langroid_app_user;
# REVOKE ROLE editor FROM langroid_app_user;