Graph-Wrecking Ball: Inside CVE-2025-66169 (Apache Camel Cypher Injection)

Amit Schendel

Senior Security Researcher

Jan 15, 2026·5 min read·1 visit

PoC Available

Executive Summary (TL;DR)

The camel-neo4j component in Apache Camel versions prior to 4.10.8, 4.14.3, and 4.17.0 used `String.format` to build Cypher queries directly from user input. This allows attackers to inject arbitrary Cypher commands, leading to potential data exfiltration or complete database deletion (DETACH DELETE). The fix involves switching to parameterized queries.

A Cypher Injection vulnerability in Apache Camel's neo4j component allows attackers to manipulate graph database queries via unsanitized string concatenation.

Attack Flow Diagram

Official Patches

ApacheOfficial Apache Camel Security Advisory

GitHubCommit fixing the vulnerability

Fix Analysis (1)

Technical Appendix

CVSS Score

6.5/ 10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Probability

0.02%

Top 100% most exploited

Affected Systems

Apache Camel (camel-neo4j component)

Affected Versions Detail

Product	Affected Versions	Fixed Version
Apache Camel Apache	4.10.0 - 4.10.7	4.10.8
Apache Camel Apache	4.14.0 - 4.14.2	4.14.3
Apache Camel Apache	4.15.0 - 4.16.0	4.17.0

Attribute	Detail
CWE ID	CWE-943 (Cypher Injection)
CVSS v3.1	6.5 (Medium)
Attack Vector	Network
EPSS Score	0.00018 (0.04%)
Impact	Data Deletion, Manipulation, Exfiltration
KEV Status	Not Listed