Key points
- CVE-2026-92681 allows unauthenticated users to execute Cypher statements via top-level fields.
- Authentication directives at the schema or type level are silently ignored for @cypher fields.
- The vulnerability is rated Critical with a CVSS score of 9.3 by the NVD.
Developers relying on the @neo4j/graphql library must upgrade to version 7.6.4 to mitigate a critical authentication bypass vulnerability. The flaw, tracked as CVE-2026-92681, allows attackers to invoke protected GraphQL fields without valid credentials. This issue affects all versions of the library prior to 7.6.4.
The National Vulnerability Database rates this weakness as Critical with a CVSS score of 9.3. According to the NVD record, the vulnerability stems from how the library handles authentication directives. Applications that expose top-level fields annotated with @cypher are at risk if they rely on broader authentication rules.
What we know
In affected versions up to and including 7.6.3, the library silently ignores @authentication directives when they are applied at the schema level or on Query or Mutation types. This behavior occurs specifically for top-level fields that are annotated with @cypher. Only authentication directives placed directly on the individual fields are enforced in these scenarios.
An application that exposes a top-level @cypher field and relies on schema-level or type-level @authentication to protect it allows unauthenticated callers to invoke the field. These callers can run the configured Cypher statement with the privileges of the GraphQL service account. This access may permit reading and modifying data within the database.
The issue is categorized under CWE-306, which relates to incorrect default permissions. The vendor has released version 7.6.4 to fix this specific behavior. Developers should verify their current library version and apply the update to ensure authentication directives are properly enforced across all field types.
Defender's checklist
- Audit GraphQL schemas for top-level fields annotated with @cypher.
- Verify that authentication directives are applied directly to each vulnerable field.
- Check current @neo4j/graphql version against the 7.6.4 release notes.
- Review access logs for unauthenticated calls to sensitive Cypher endpoints.
What to do and how to stay safe: Neo4j
- Inventory all projects using @neo4j/graphql to identify affected versions.
- Update the library to version 7.6.4 or later as soon as possible.
- Test authentication flows for top-level @cypher fields after updating.
- Monitor application logs for suspicious unauthenticated query attempts.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of @neo4j/graphql are affected by CVE-2026-92681?
Versions up to and including 7.6.3 are affected by this authentication bypass vulnerability.
What is the CVSS score for this vulnerability?
The NVD assigns a CVSS score of 9.3, rating the severity as Critical.
How does the vulnerability allow unauthenticated access?
Schema-level or type-level @authentication directives are silently ignored for top-level @cypher fields, allowing unauthorized execution.
