## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-OSCERD-CVE-2026-46591
# camel-neo4j Cypher Injection Reproducer (CVE-2026-46591)
This project demonstrates a **Cypher injection** in Apache Camel's `camel-neo4j` component, tracked as **CVE-2026-46591**. The producer builds the Cypher `WHERE` clause for its match/retrieve and delete operations from the `CamelNeo4jMatchProperties` map. **CVE-2025-66169** addressed injection through the property _values_ by binding them as query parameters (`$paramN`) — but the property _names_ (the JSON keys of that map) are still concatenated into the query string **verbatim** in `Neo4jProducer.retrieveNodes()` and `deleteNode()`. A property name containing Cypher syntax therefore alters the structure of the executed query.
This PoC demonstrates the impact as **authorization bypass / data exfiltration** : an attacker puts Cypher in a JSON key so that a `:Person` lookup is rewritten (via ) to also return a node it was never meant to touch — matching the advisory's "read, modify or delete any node or relationship".