External risk intelligence

@neo4j/graphql Authentication Bypass for Cypher Fields

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-92681

This vulnerability affects a GraphQL library commonly used to build web APIs. Because these APIs are frequently exposed as internet-facing endpoints to serve client applications or public services, the vulnerable surface is commonly reachable from the internet in standard deployment patterns.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in a GraphQL library that could allow unauthenticated users to execute sensitive Cypher queries, potentially leading to unauthorized data access or modification. This occurs because authentication directives intended to protect schema-level or type-level configurations are not consistently enforced for certain types of fields.

Authentication rules are ignored for some fields.
Protects against unauthorized data access.
Confirm if your GraphQL services are exposed.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by sending unauthenticated requests to a GraphQL endpoint. The application, unaware of the ignored authentication directives on top-level fields, would allow any caller to execute the associated Cypher statement using the GraphQL service account's privileges, potentially leading to unauthorized data access or modification.

No authentication required.
Trigger via unauthenticated GraphQL queries.
Risk of unauthorized data access.

Live Threat

Current exploitation, exposure, and threat context

When authentication directives are ignored for specific fields, unauthenticated callers could invoke those fields. This could allow them to execute configured Cypher statements with the privileges of the GraphQL service account, potentially leading to unauthorized reading and modification of data.

System data and sensitive information.
Unauthenticated callers can execute queries.
Unauthorized data access and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners, likely those responsible for the GraphQL API layer, should take the lead in addressing this vulnerability. The immediate first step is to identify all instances of the affected library, confirm their exposure and business criticality, and then determine the appropriate remediation plan.

Application owners should own the issue.
Verify schema-level authentication bypass.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is @neo4j/graphql?

@neo4j/graphql is a library used by developers to build GraphQL APIs that interact with Neo4j graph databases. It translates GraphQL queries into Cypher, the graph query language, allowing applications to easily read and write data in the database. Developers use it to simplify API creation by automating the mapping between their data model and the database structure.

What weakness does CVE-2026-92681 represent?

This vulnerability is classified as CWE-306, which refers to Missing Authentication for Critical Function. In this specific case, the library fails to enforce security rules when they are defined broadly at the schema or object type level for certain fields. Because the system does not check for authentication as expected, it incorrectly permits access to protected operations.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a crafted GraphQL query to an endpoint that exposes a top-level field defined with the @cypher directive. The vulnerability is only triggered when security rules are placed at the schema or type level; it is NOT triggered if the @authentication directive is correctly applied directly to the specific individual field being targeted.

Is my application at risk if it uses this library?

Halo Surface Signal indicates that because this library is typically used to build web APIs, these services are often reachable from the internet to support client applications. If your GraphQL API is exposed to the internet, it is at higher risk. You should determine if you have any top-level @cypher fields that rely on broad schema or type-level authentication rules.

What is the first step to remediate CVE-2026-92681?

The primary step is to upgrade your @neo4j/graphql dependency to version 7.6.4 or later. In the meantime, you should audit your GraphQL schema to identify fields using @cypher that currently depend on schema-level or type-level authentication, and move those security directives directly onto the affected fields to ensure they are properly enforced.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.