Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.9

Neo4j Enterprise may let later users inherit first login

CVE-2026-1471 · published 7 months ago
Summary

Versions of Neo4j Enterprise before the 2026.1.4 update can keep authentication details in memory for too long. After a restart, a user who logs in later may unintentionally receive the access rights of the first user who logged in. Updating Neo4j Enterprise to version 2026.1.4 (or 5.26.22) resolves the issue.

What to do
  • Update neo4j to version 2026.1.4.
  • Update neo4j-enterprise to version 2026.1.4.
Affected software
Ecosystem VendorProductAffected versions
Bitnami – neo4j >= 2025.1.0, < 2026.1.4
Fix: upgrade to 2026.1.4
Bitnami – neo4j-enterprise >= 2025.1.0, < 2026.1.4
Fix: upgrade to 2026.1.4
– neo4j neo4j < 5.26.22
>= 2025.01.0, < 2026.01.4
cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:*
Original advisory text
Caching of authentication context
Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint). 
We recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.9 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published11 Mar 2026
Updated4 Nov 2026
First seen11 Mar 2026
Sources
CVE-2026-1471 · NVD
BIT-neo4j-2026-1471 · OSV
BIT-neo4j-enterprise-2026-1471 · OSV
CVE-2026-1471 · OSV
Track software like this
Free during beta