CVE-2026-1471

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1471", "assignerOrgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "state": "PUBLISHED", "assignerShortName": "Neo4j", "dateReserved": "2026-01-27T09:09:22.753Z", "datePublished": "2026-03-11T16:30:24.053Z", "dateUpdated": "2026-03-11T20:09:18.652Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "shortName": "Neo4j", "dateUpdated": "2026-03-11T16:30:24.053Z"}, "title": "Caching of authentication context", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "type": "CWE"}]}], "affected": [{"vendor": "Neo4j", "product": "Enterprise edition", "versions": [{"status": "affected", "version": "2025.01", "lessThan": "2026.01.4", "versionType": "date"}, {"status": "affected", "version": "4.4.0", "lessThan": "5.26.22", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:neo4j:enterprise_edition:*:*:*:*:*:*:*:*", "versionStartIncluding": "2025.01", "versionEndExcluding": "2026.01.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:neo4j:enterprise_edition:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.0", "versionEndExcluding": "5.26.22"}]}]}], "descriptions": [{"lang": "en", "value": "Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint).\u00a0\nWe recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint).&nbsp;<br>We recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.&nbsp;"}]}], "references": [{"url": "https://neo4j.com/security/CVE-2026-1471", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NO", "Recovery": "USER", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "CLEAR", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L/U:Clear"}}], "workarounds": [{"lang": "en", "value": "Set dbms.security.oidc.<provider>.get_groups_from_user_info and\u00a0dbms.security.oidc.<provider>.get_username_from_user_info to false.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<code>Set dbms.security.oidc.&lt;provider&gt;.get_groups_from_user_info</code> and&nbsp;<code>dbms.security.oidc.&lt;provider&gt;.get_username_from_user_info to false.</code><br><br>"}]}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T20:08:47.580869Z", "id": "CVE-2026-1471", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T20:09:18.652Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1471", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T20:08:47.580869Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T20:08:55.401Z"}}], "cna": {"title": "Caching of authentication context", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 2.1, "Automatable": "NO", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L/U:Clear", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "CLEAR", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Neo4j", "product": "Enterprise edition", "versions": [{"status": "affected", "version": "2025.01", "lessThan": "2026.01.4", "versionType": "date"}, {"status": "affected", "version": "4.4.0", "lessThan": "5.26.22", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://neo4j.com/security/CVE-2026-1471", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "Set dbms.security.oidc.<provider>.get_groups_from_user_info and\u00a0dbms.security.oidc.<provider>.get_username_from_user_info to false.", "supportingMedia": [{"type": "text/html", "value": "<code>Set dbms.security.oidc.&lt;provider&gt;.get_groups_from_user_info</code> and&nbsp;<code>dbms.security.oidc.&lt;provider&gt;.get_username_from_user_info to false.</code><br><br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint).\u00a0\nWe recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.", "supportingMedia": [{"type": "text/html", "value": "Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint).&nbsp;<br>We recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.&nbsp;", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:neo4j:enterprise_edition:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2026.01.4", "versionStartIncluding": "2025.01"}, {"criteria": "cpe:2.3:a:neo4j:enterprise_edition:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.26.22", "versionStartIncluding": "4.4.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "shortName": "Neo4j", "dateUpdated": "2026-03-11T16:30:24.053Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1471", "state": "PUBLISHED", "dateUpdated": "2026-03-11T20:09:18.652Z", "dateReserved": "2026-01-27T09:09:22.753Z", "assignerOrgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "datePublished": "2026-03-11T16:30:24.053Z", "assignerShortName": "Neo4j"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Enterprise edition", "vendor": "Neo4j", "versions": [{"lessThan": "2026.01.4", "status": "affected", "version": "2025.01", "versionType": "date"}, {"lessThan": "5.26.22", "status": "affected", "version": "4.4.0", "versionType": "semver"}]}], "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "2F0CBF4C-6B09-4AF9-9A75-C079D06F8791", "versionEndExcluding": "5.26.22", "vulnerable": true}, {"criteria": "cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "2777E666-109C-43B9-BCA5-0A09F86299C4", "versionEndExcluding": "2026.01.4", "versionStartIncluding": "2025.01.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint).\u00a0\nWe recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed."}, {"lang": "es", "value": "El almacenamiento en cach\u00e9 excesivo del contexto de autenticaci\u00f3n en versiones de Neo4j Enterprise edition anteriores a 2026.01.4 lleva a que los usuarios autenticados hereden el contexto del primer usuario que se autentic\u00f3 despu\u00e9s del reinicio. El problema se limita a ciertas configuraciones no predeterminadas de SSO (punto final UserInfo). Recomendamos actualizar a las versiones 2026.01.4 (o 5.26.22) donde el problema est\u00e1 solucionado."}], "id": "CVE-2026-1471", "lastModified": "2026-06-17T10:15:51.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "CLEAR", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Clear", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "LOW"}, "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1471", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T20:08:47.580869Z", "version": "2.0.3"}}]}, "published": "2026-03-11T17:16:54.160", "references": [{"source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "tags": ["Vendor Advisory"], "url": "https://neo4j.com/security/CVE-2026-1471"}], "sourceIdentifier": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6", "type": "Secondary"}]}

{"bugzilla": {"description": "neo4j: Neo4j: Authentication context inheritance via excessive caching in SSO UserInfo endpoint", "id": "2446566", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446566"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-488", "details": ["A flaw was found in Neo4j. Authenticated users can inherit the authentication context of the first user who authenticated after a system restart. This occurs due to excessive caching of authentication context in certain non-default configurations of the Single Sign-On (SSO) UserInfo endpoint. This could lead to unauthorized access to resources or actions intended for the initial user."], "name": "CVE-2026-1471", "package_state": [{"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "camel-neo4j", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "neo4j-bolt-connection", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "neo4j-bolt-connection-netty", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "neo4j-bolt-connection-pooled", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "neo4j-bolt-connection-routed", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "neo4j-java-driver", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Fix deferred", "package_name": "neo4j-ogm-core", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "neo4j", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "neo4j", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-model-registry-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/oc-mirror-plugin-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/dashboard-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/devspaces-operator-bundle", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-03-11T16:30:24Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-1471\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-1471\nhttps://neo4j.com/security/CVE-2026-1471"], "statement": "This LOW impact vulnerability affects Neo4j Enterprise edition versions prior to 2026.01.4. Authenticated users may inherit another user's authentication context due to excessive caching in SSO. Exploitation requires high complexity\u2014non-default SSO configuration and timing relative to restart. Impact is limited since the attacker cannot control whose context they inherit. Red Hat products are affected if using vulnerable Neo4j versions with SSO UserInfo endpoint enabled.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2025.01,2026.01.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.4.0,5.26.22)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Enterprise edition", "source": "cna", "vendor": "Neo4j"}, "product": "enterprise_edition", "vendor": "neo4j"}], "analysis": {"en": {"generated_at": "2026-03-17T15:28:41.012898+00:00", "value": {"mitigation_remediation": ["Upgrade Neo4j Enterprise Edition to version 2026.01.4 or later (5.26.22 or newer).", "If upgrading is not immediately possible, disable context inheritance for non\u2011default SSO by setting dbms.security.oidc.<provider>.get_groups_from_user_info and dbms.security.oidc.<provider>.get_username_from_user_info to false."], "summary": {"action": "Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The issue affects Neo4j Enterprise Edition prior to version 2026.01.4 (or 5.26.22). It is active only when non-default SSO (UserInfo endpoint) configurations are in use, such that the server caches the first authenticated user\u2019s context. All affected installations matching these criteria are potentially impacted until the software is upgraded.", "description_and_impact": "Neo4j Enterprise Edition has a flaw where an authenticated user can inherit the authentication context of the first user who logs in after a server restart. Key detail from vendor description: \"Excessive caching of authentication context\u2026 leads to authenticated users inheriting the context of the first user who authenticated after restart.\" The vulnerability is classified as CWE-488 (Improper Cache Management) and CWE-863 (Incorrect Permission Management), indicating that cached authentication data can be reused incorrectly and that permission checks are not properly enforced, which may allow an attacker to gain higher privileges than intended.", "risk_and_exploitability": "The CVSS score of 2.1 indicates low severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred from the description: the attacker must be authenticated, wait until a restart occurs, and then log in first after the restart to inherit the privileged context of that session. Because this requires specific timing and logged\u2011in status, the overall risk remains low under normal operational conditions, though the potential impact of privilege escalation is significant if an attacker succeeds."}}}}, "created": "2026-03-12T09:57:53.937474+00:00", "updated": "2026-03-20T15:30:33.110171+00:00", "vendors": ["neo4j", "neo4j$PRODUCT$enterprise_edition"]}