Neo4j Enterprise and Community editions versions prior to 2026.01.3 and 5.26.21 are vulnerable to a potential information disclosure by a user who has ability to access the local log files. The "obfuscate_literals" option in the query logs does not redact error information, exposing unredacted data in the query log when a customer writes a query that fails. It can allow a user with legitimate access to the local log files to obtain information they are not authorised to see. If this user is also in a position to run queries and trigger errors, this vulnerability can potentially help them to infer information they are not authorised to see through their intended database access. We recommend upgrading to versions 2026.01.3 (or 5.26.21) where the issue is fixed, and reviewing query log files permissions to ensure restricted access. If your configuration had db.logs.query.obfuscate_literals enabled, and you wish the obfuscation to cover the error messages as well, you need to enable the new configuration setting db.logs.query.obfuscate_errors once you have upgraded Neo4j.

According to its self-reported version number, the version of Neo4j running on the remote host is a version prior to 5.26.21. It is, therefore, affected by a information disclosure vulnerability where The obfuscate_literals option in the query logs does not redact error information, exposing unredacted data in the query log when a customer writes a query that fails. It can allow a user with legitimate access to the local log files to obtain information they are not authorised to see.
    Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Neo4j Enterprise and Community editions versions prior to 2026.01.3 and 5.26.21 are vulnerable to a
    potential information disclosure by a user who has ability to access the local log files. The
    "obfuscate_literals" option in the query logs does not redact error information, exposing unredacted data
    in the query log when a customer writes a query that fails. It can allow a user with legitimate access to
    the local log files to obtain information they are not authorised to see. If this user is also in a
    position to run queries and trigger errors, this vulnerability can potentially help them to infer
    information they are not authorised to see through their intended database access. We recommend upgrading
    to versions 2026.01.3 (or 5.26.21) where the issue is fixed, and reviewing query log files permissions to
    ensure restricted access. If your configuration had db.logs.query.obfuscate_literals enabled, and you wish
    the obfuscation to cover the error messages as well, you need to enable the new configuration setting
    db.logs.query.obfuscate_errors once you have upgraded Neo4j. (CVE-2026-1622)

ID	Name	Product	Family	Severity
298972	Neo4j < 5.26.21 Information Disclosure Vulnerability (CVE-2026-1622)	Nessus	CGI abuses	medium
437545	SCA: security update for org.neo4j:neo4j (GHSA-4j3g-rwwq-4p54)	Tenable Cloud Security	SCA Checks	medium
437545	SCA: security update for org.neo4j:neo4j (GHSA-4j3g-rwwq-4p54)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-1622

medium

Tenable Plugins

medium

medium

medium