The Apache Camel Neo4j component constructs a Cypher WHERE clause by concatenating JSON keys from the CamelNeo4jMatchProperties header directly into the query string. Property values are safely bound, but the property names are not validated before injection. This flaw, classified as CWE‑943, allows an attacker who can control the key names to modify the query structure, resulting in arbitrary Cypher injection that can read, modify or delete any node or relationship in the Neo4j database, thereby compromising confidentiality, integrity and availability.

The vulnerability affects Apache Camel 4.10.0 through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.9. Versions 4.14.8, 4.18.3 and 4.21.0 contain the fix and should be adopted where possible.

The CVSS score of 8.2 indicates high severity, while the EPSS score of less than 1% reflects a low but non‑zero chance of exploitation. The flaw is not listed in CISA’s KEV catalog. Attackers must inject malicious property names into the CamelNeo4jMatchProperties header; typical entry points are routes that map request bodies or consumer‑originating data into this header, or routes that fail to sanitize inbound Camel* headers. Even though the header is camel‑prefixed and filtered by HTTP header strategies, untrusted data can reach it through internal routing, enabling an attacker to execute malicious Cypher against the connected Neo4j database.