CVE-2026-92681: Neo4j GraphQL Auth Bypass Vulnerability

CVE-2026-92681 Overview

CVE-2026-92681 is an authentication bypass vulnerability in the @neo4j/graphql library affecting versions up to and including 7.6.3. The library silently ignores @authentication directives applied at the schema level or on Query and Mutation types when those apply to top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual field are enforced. Applications relying on schema-level or type-level authentication to protect top-level @cypher fields allow unauthenticated callers to invoke the field. The invoked Cypher statement executes with the privileges of the GraphQL service account, enabling unauthorized reading and modification of graph data. The issue is tracked under [CWE-306: Missing Authentication for Critical Function] and is fixed in version 7.6.4.

Critical Impact

Unauthenticated remote attackers can execute Cypher statements against the backing Neo4j database with the GraphQL service account's privileges, resulting in confidentiality and integrity loss.

Affected Products

• @neo4j/graphql versions <= 7.6.3
• GraphQL schemas exposing top-level fields annotated with @cypher
• Applications protecting @cypher fields via schema-level or Query/Mutation type-level @authentication directives

Discovery Timeline

• 2026-10-12 - CVE-2026-92681 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-92681

Vulnerability Analysis

The @neo4j/graphql library allows developers to attach @authentication directives at three scopes: the schema level, the Query/Mutation type level, and the individual field level. For regular GraphQL fields, the authentication middleware walked all three scopes before resolution. For top-level fields annotated with @cypher, the translation path used a dedicated resolver (translate-top-level-cypher.ts) that invoked applyAuthentication only on the schema-level annotation and did not evaluate type-level or object-level annotations correctly for the @cypher resolver chain.

The practical effect is that developers who declared authentication once at the schema or Query type level, expecting that policy to cover every field, left top-level @cypher fields unprotected. The Cypher statement bound to the field runs under the GraphQL service account, which typically has broad read and write access to the graph.

Root Cause

The root cause is incomplete enforcement logic in the @cypher field translation path. The patch replaces the single applyAuthentication call with a new applyAuthenticationAnnotations helper that resolves the field attribute from the operation adapter and applies schema-level, type-level, and field-level annotations consistently. See the referenced patch below for the corrected control flow in check-authentication.ts and translate-top-level-cypher.ts.

Attack Vector

An unauthenticated attacker sends a GraphQL query or mutation that invokes a top-level @cypher field over the network. No credentials, user interaction, or special privileges are required. The server translates the field to the bound Cypher statement and executes it against Neo4j using the service account, returning results or committing writes to the attacker.

// Patch excerpt: packages/graphql/src/translate/authorization/check-authentication.ts
export const isAuthenticated =
-    (targetOperations: AuthenticationOperation[], entity: Operation | undefined) =>
+    (targetOperations: AuthenticationOperation[], operation: Operation | undefined) =>
     (next) =>
     (root, args, context, info) => {
-        const schemaLevelAnnotation = context.schemaModel.annotations.authentication;
-        if (schemaLevelAnnotation) {
-            applyAuthentication({ context, annotation: schemaLevelAnnotation, targetOperations });
-        }
+        applyAuthenticationAnnotations({ context, operation, targetOperations, fieldName: info.fieldName });
+        return next(root, args, context, info);
+    };

+export function applyAuthenticationAnnotations({
+    context,
+    operation,
+    targetOperations,
+    fieldName,
+}: {
+    context: Neo4jGraphQLTranslationContext;
+    operation: Operation | undefined;
+    targetOperations: AuthenticationOperation[];
+    fieldName: string;
+}): void {
+    const field = operation?.findAttribute(fieldName) ?? operation?.findUserResolvedAttributes(fieldName);
+    // schema, type, and field annotations now evaluated here
+}

Source: GitHub commit ef69cc6

Detection Methods for CVE-2026-92681

Indicators of Compromise

• GraphQL requests to top-level @cypher-annotated fields that lack an Authorization header or valid JWT.
• Neo4j query logs showing Cypher execution tied to the GraphQL service account but no correlated authenticated session.
• Spikes in read volume or write operations originating from the GraphQL application identity.

Detection Strategies

• Enumerate the GraphQL SDL for any top-level Query or Mutation field annotated with @cypher and verify that @authentication is applied directly on the field.
• Replay unauthenticated requests against known @cypher fields in a staging environment to confirm whether they resolve without credentials.
• Correlate GraphQL access logs with Neo4j audit logs to flag Cypher execution that does not map to an authenticated principal.

Monitoring Recommendations

• Enable Neo4j query logging and ship logs to a central analytics platform for longitudinal review.
• Alert on unauthenticated GraphQL requests that resolve successfully against fields known to be backed by @cypher.
• Track the installed version of @neo4j/graphql across build artifacts and container images to detect regressions to vulnerable versions.

How to Mitigate CVE-2026-92681

Immediate Actions Required

• Upgrade @neo4j/graphql to 7.6.4 or later in all services that expose a GraphQL endpoint.
• Audit the schema for every top-level @cypher field and add an @authentication directive directly on the field as a defense-in-depth measure.
• Rotate credentials for the Neo4j service account used by the GraphQL layer if logs indicate possible unauthenticated access.

Patch Information

The vulnerability is fixed in @neo4j/graphql version 7.6.4. The fix centralizes authentication annotation evaluation in a new applyAuthenticationAnnotations function that is invoked from both the generic middleware and the top-level @cypher translation path. See the GitHub Security Advisory GHSA-8xj4-8gg9-fx9h, the v7.6.4 release notes, and the NPM package page.

Workarounds

• Place an @authentication directive directly on every top-level @cypher field until the upgrade is deployed.
• Restrict the Neo4j service account bound to the GraphQL layer to the minimum roles required, limiting the blast radius of unauthenticated Cypher execution.
• Enforce authentication at an upstream API gateway or reverse proxy so unauthenticated GraphQL requests cannot reach the resolver.

# Upgrade to the fixed version
npm install @neo4j/graphql@^7.6.4

# Verify the installed version
npm ls @neo4j/graphql