Neo4j GraphQL Library Fixes Critical Authentication Bypass in Version 7.6.4
A critical flaw in Neo4j’s GraphQL library allowed unauthenticated users to execute Cypher queries, a vulnerability now patched in version 7.6.4.
Key points
- CVE-2026-92681 is rated Critical with a CVSS score of 9.3.
- Authentication directives were ignored on top-level Cypher fields in versions up to 7.6.3.
- The fix is available in version 7.6.4 for the @neo4j/graphql package.
Neo4j has released version 7.6.4 of its @neo4j/graphql library to address a critical authentication bypass vulnerability. The flaw, tracked as CVE-2026-92681, allows unauthenticated callers to execute Cypher statements with the privileges of the GraphQL service account.
At a glance
- CVE
- CVE-2026-92681
- Product
- @neo4j/graphql
- CVSS
- 9.3 Critical
- Weakness
- missing authentication
- Exploited
- No known exploitation
The National Vulnerability Database assigns the issue a CVSS score of 9.3, classifying it as critical. The weakness stems from how the library handles authentication directives in specific schema configurations. This rating reflects the high potential for unauthorized data access and modification.
Context and Background
In versions of the @neo4j/graphql library up to and including 7.6.3, authentication directives applied at the schema level were silently ignored. This behavior also affected directives placed on the Query or Mutation types when those types contained top-level fields annotated with @cypher.
Only authentication directives placed directly on the individual fields were enforced in these earlier versions. Consequently, applications relying on broader schema-level or type-level protection left their Cypher fields exposed. This discrepancy between expected and actual enforcement created a significant security gap.
Who Is Affected
Developers using the @neo4j/graphql package prior to version 7.6.4 are affected by this vulnerability. Specifically, those who expose top-level @cypher fields and depend on schema-level or type-level @authentication directives to protect them are at risk.
An application configured in this manner allows unauthenticated callers to invoke the field. These callers can then run the configured Cypher statement with the privileges of the GraphQL service account. This access may permit reading and modifying data within the Neo4j database.
What should you do?
Organizations should verify if they are using affected versions of the Neo4j GraphQL library. Immediate attention is required for any service exposing top-level Cypher fields with broad authentication directives. Users should plan to upgrade to version 7.6.4 as soon as possible to enforce proper authentication checks on these fields.
What to do and how to stay safe: Neo4j
- Audit your GraphQL schema for top-level fields annotated with @cypher to identify potential exposure points.
- Check your current version of the @neo4j/graphql package to determine if it is 7.6.3 or earlier.
- Review authentication directives to ensure they are applied directly to fields rather than only at the schema level.
- Upgrade to version 7.6.4 once the vendor provides the update to mitigate the bypass.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-92681?
The CVSS score is 9.3, which is rated as Critical.
Which versions of the library are vulnerable?
Versions up to and including 7.6.3 are affected by this authentication bypass flaw.
How was the vulnerability exploited?
Unauthenticated callers could invoke top-level @cypher fields if authentication was only set at the schema level.
