Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Neo4j bug bounty programs

neo4j.com Updated

Neo4j runs two public programs: a Sorona bug bounty paying up to $1,500 and a self-hosted disclosure program with no cash rewards.

Top reward
$1,500
Sorona
Programs
2
1 pays cash
Targets in scope
13
2 types, deduplicated
Last change
None yet
Tracked since Nov 2026

Where to report

2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Neo4j

Sorona · Pays the most of the 2 programs: up to $1,500.
  • Neo4j

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100 (highest)
    Safe harbor
    Partial
  • Neo4j

    Self-hosted · Disclosure only

    Open

    Top reward

    No cash
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

13 targets across all 2 programs, each listed once with the programs that cover it. 39 excluded.

  • https://neo4j.com

    Web

    Covered by Sorona

  • Authentication and authorization: native auth, password storage and reset, session and token handling, and the role and privilege checks behind every operation

    Products and areas

    Covered by Sorona

  • Configuration parsing and the defaults a server runs with when an operator changes nothing

    Products and areas

    Covered by Sorona

  • Cypher parsing and execution in full, covering parameters, procedure and function invocation, subqueries and dynamic query construction

    Products and areas

    Covered by Sorona

  • Import and export handling: LOAD CSV, the configured import directory and the setting meant to confine reads to it, plus any path that fetches a URL a caller supplied

    Products and areas

    Covered by Sorona

  • Logging and the query log, including what a credential or a parameter value looks like once it has been written down

    Products and areas

    Covered by Sorona

  • The administration tooling that ships with the distribution, covering neo4j-admin, dump and load, backup and restore, and the files they read

    Products and areas

    Covered by Sorona

  • The Bolt protocol server: the handshake, the authentication exchange, message framing and everything a client can send before it is authenticated

    Products and areas

    Covered by Sorona

  • The embedded library use, where Neo4j runs inside another JVM application rather than as a server

    Products and areas

    Covered by Sorona

  • The HTTP API and the bundled Neo4j Browser, including the endpoints the browser calls on an operator's behalf

    Products and areas

    Covered by Sorona

  • The procedure sandbox and any path from a callable procedure to the JVM, the filesystem or an outbound network request

    Products and areas

    Covered by Sorona

  • The trust-centre policy takes vulnerability reports on Neo4j products through its responsible-disclosure process and offers acknowledgement in place of money. It publishes no narrow asset list for the database itself, so the Community Edition tree is the target and nothing inside it is carved out

    Products and areas

    Covered by Sorona

  • User-defined procedures and functions, the plugin loading path, and the settings that decide which procedures an unprivileged user may call

    Products and areas

    Covered by Sorona

No target matches. Try part of a host name, such as the company name.

Out of scope 39

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Account enumeration attacks

    Self-hosted

  • An instance deliberately started with authentication disabled or with an administrative account handed out, which is a configuration decision

    Sorona

  • Any issues related to credential stuffing and account takeover

    Self-hosted

  • Any other submissions determined to be low risk, based on unlikely hypothetical attack vectors, requiring significant user interaction, or resulting in minimal impact

    Self-hosted

  • Attacks targeting outdated or obscure browsers

    Self-hosted

  • Attacks that rely on presenting the user with fake UI that is visually identical to Neo4j UI

    Self-hosted

  • Best practices deviation (password complexity, expiration, re-use etc)

    Self-hosted

  • Bugs that do not represent security risk

    Self-hosted

  • Bypassing rate limits or the non-existence of rate limits that have no platform impact (don’t execute DoS to “prove” impact!)

    Self-hosted

  • Clickjacking on pre-authenticated pages and missing anti-clickjacking headers

    Self-hosted

  • Clickjacking on pre-authenticated pages, lack of anti-clickjacking headers, or other non-exploitable clickjacking issues

    Self-hosted

  • Content spoofing and text injection issues without being able to modify HTML/CSS

    Self-hosted

  • Credential stuffing and account takeover

    Self-hosted

  • CSRF with no security impact

    Self-hosted

  • CSRF with no security impact (unathenticated/login/logout CSRF)

    Self-hosted

  • Deviation from best practices, information disclosures, verbose or unique error pages, stack traces (without substantive proof of concept of exploitability)

    Self-hosted

  • Enterprise Edition features, which are commercial rather than part of the open-source target here, even though the vendor's own process accepts reports on them

    Sorona

  • Exposure of internal domains on public domains

    Self-hosted

  • Findings against a version line the vendor no longer supports

    Sorona

  • Hardcoded API keys in applications (without substantive demonstration of significant risk)

    Self-hosted

  • Homograph links

    Self-hosted

  • HTTP TRACE or OPTIONS methods enabled

    Self-hosted

  • Insecure cookie settings or flags on non-sensitive cookies

    Self-hosted

  • Insecure cookie settings/flags on non-sensitive cookies

    Self-hosted

  • Issues only affecting outdated, unpatched or non-default installations

    Self-hosted

  • Known vulnerable libraries without a novel and working Proof of Concept

    Self-hosted

  • Lack of security-related headers

    Self-hosted

  • Language drivers maintained in their own repositories, where the defect is in the driver rather than the server

    Sorona

  • Opinions on design/architecture

    Self-hosted

  • Out of date software or libraries

    Self-hosted

  • Reflected file download

    Self-hosted

  • Resource exhaustion from an expensive Cypher query, which is a capacity question rather than a defect

    Sorona

  • Self-XSS and issues exploitable only through self-XSS

    Self-hosted

  • Spam or social engineering techniques

    Self-hosted

  • Third-party procedure libraries and plugins that do not ship with the distribution

    Sorona

  • Vulnerabilities only affecting users of outdated or unpatched versions, or installations where the configuration is weakened from the default out of the box options

    Self-hosted

  • Vulnerabilities requiring physical access to the victim’s unlocked computer or device; pre-existing root/system privileges or MITM on the victim’s computer or device

    Self-hosted

  • Weak SSL/TLS algorithms, protocols or cyphers

    Self-hosted

  • Weak SSL/TLS algorithms, protocols, or cyphers

    Self-hosted

Recent changes

Reward and scope changes across every Neo4j program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Neo4j products, from the NVD.

Search NVD
  • CVE-2026-14587 Medium

    Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for more bytes instead of rejecting the protocol message and closing the channel. Because the same unread byt

  • CVE-2026-14587 Medium

    Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for more bytes instead of rejecting the protocol message and closing the channel. Because the same unread byt

  • CVE-2026-1524 Low

    An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provid

  • CVE-2026-1471 Low

    Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint). We recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.

  • CVE-2026-1524 Low

    An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provid

  • CVE-2026-1471 Low

    Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint). We recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.

  • CVE-2026-1497 Low

    Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any local database or remote alias called "name". If such database or alias doesn't exist when the command is

  • CVE-2026-1497 Low

    Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any local database or remote alias called "name". If such database or alias doesn't exist when the command is

About this page

This page gathers every public program listed under neo4j.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.