Key points
- CVE-2026-92681 carries a CVSS score of 9.3, rated as critical severity.
- Authentication directives at the schema or type level are ignored for top-level @cypher fields.
- The vulnerability is resolved in version 7.6.4 of the @neo4j/graphql library.
A critical authentication bypass vulnerability in the Neo4j GraphQL library allows attackers to execute database queries without proper credentials. This flaw affects all versions of @neo4j/graphql up to and including 7.6.3, exposing applications to unauthorized data access and modification.
The issue, tracked as CVE-2026-92681, has been assigned a CVSS score of 9.3, which the National Vulnerability Database rates as critical. According to the NVD record, the weakness stems from how the library handles authentication directives when they are applied broadly rather than to specific fields.
How the Authentication Bypass Works
In affected versions, @authentication directives applied at the schema level or on Query and Mutation types are silently ignored for top-level fields annotated with @cypher. Only authentication directives placed directly on individual fields are enforced. This discrepancy creates a significant security gap for developers who rely on broader authentication rules.
An application that exposes a top-level @cypher field and relies on schema-level or type-level @authentication to protect it allows unauthenticated callers to invoke that field. These callers can then run the configured Cypher statement with the privileges of the GraphQL service account, potentially permitting the reading and modifying of sensitive data.
Who Is Affected by This Flaw
The vulnerability impacts any organization using the @neo4j/graphql library in versions prior to 7.6.4. System administrators and developers who have deployed applications using schema-level authentication for Cypher queries are at immediate risk. The flaw is classified under CWE-306, which relates to incorrect default permissions.
Business leaders should note that this issue does not require complex exploitation. Any unauthenticated user who can access the GraphQL endpoint can trigger the vulnerable fields. This means that the privilege level of the underlying GraphQL service account determines the extent of potential data exposure and modification.
Next steps
The Neo4j team has released version 7.6.4 of the @neo4j/graphql library to fix this vulnerability. Organizations running older versions should update their dependencies immediately to block this authentication bypass. Until the update is applied, administrators may need to manually enforce authentication on each individual @cypher field to mitigate the risk.
What to do and how to stay safe: Neo4j
- Audit your GraphQL schema to identify all top-level fields annotated with @cypher.
- Verify that authentication directives are applied directly to each vulnerable field, not just at the schema level.
- Update the @neo4j/graphql library to version 7.6.4 or later as soon as possible.
- Monitor application logs for unauthorized query executions from unauthenticated sources.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-92681?
The National Vulnerability Database assigns a CVSS score of 9.3 to this vulnerability, rating it as critical.
Which versions of Neo4j GraphQL are affected?
All versions of @neo4j/graphql up to and including 7.6.3 are affected by this authentication bypass flaw.
How can organizations fix this vulnerability?
Organizations should update their @neo4j/graphql library to version 7.6.4, which contains the fix for CVE-2026-92681.
