Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Neo4j

Bug bounty on Sorona neo4j.com

Accepting reports open-source
Go to program Website
Top reward
$1,500
Top severity paid
Critical
Assets in scope
13
Public CVEs
15
Last change
No changes yet

At a glance

What to know before you start testing.

Pays from $1,500
for critical bugs.
Report on Sorona
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
Publish after a fix
Coordinate the timing with the company.

Rewards

What Sorona lists as the payout for each severity.

Severity Reward
Critical $1,500+
High $700+
Medium $300+
Low $100 $100 / 1 month Claude Max
Safe harbor
Partial Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Hall of fame
Yes Reporters are credited on a public acknowledgments list.

Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

13 assets you may test, 6 excluded.

Web 1

  • https://neo4j.com

Products and areas 12

  • Authentication and authorization: native auth, password storage and reset, session and token handling, and the role and privilege checks behind every operation
  • Configuration parsing and the defaults a server runs with when an operator changes nothing
  • Cypher parsing and execution in full, covering parameters, procedure and function invocation, subqueries and dynamic query construction
  • Import and export handling: LOAD CSV, the configured import directory and the setting meant to confine reads to it, plus any path that fetches a URL a caller supplied
  • Logging and the query log, including what a credential or a parameter value looks like once it has been written down
  • The administration tooling that ships with the distribution, covering neo4j-admin, dump and load, backup and restore, and the files they read
  • The Bolt protocol server: the handshake, the authentication exchange, message framing and everything a client can send before it is authenticated
  • The embedded library use, where Neo4j runs inside another JVM application rather than as a server
  • The HTTP API and the bundled Neo4j Browser, including the endpoints the browser calls on an operator's behalf
  • The procedure sandbox and any path from a callable procedure to the JVM, the filesystem or an outbound network request
  • The trust-centre policy takes vulnerability reports on Neo4j products through its responsible-disclosure process and offers acknowledgement in place of money. It publishes no narrow asset list for the database itself, so the Community Edition tree is the target and nothing inside it is carved out
  • User-defined procedures and functions, the plugin loading path, and the settings that decide which procedures an unprivileged user may call
Out of scope (6)
  • An instance deliberately started with authentication disabled or with an administrative account handed out, which is a configuration decision
  • Enterprise Edition features, which are commercial rather than part of the open-source target here, even though the vendor's own process accepts reports on them
  • Findings against a version line the vendor no longer supports
  • Language drivers maintained in their own repositories, where the defect is in the driver rather than the server
  • Resource exhaustion from an expensive Cypher query, which is a capacity question rather than a defect
  • Third-party procedure libraries and plugins that do not ship with the distribution

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.

While testing

  • Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
  • Encrypt with the published PGP key where the finding warrants it. The key is advertised in the security.txt alongside the policy
  • Say which edition you tested. Community Edition is the open-source build and the target here, and several authorization features exist only in the commercial edition
  • Include the Cypher that reproduces it, the procedure allow-list and sandbox settings in force, and any plugin that was loaded, since most of this surface depends on server configuration
  • You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined.

Not accepted

  • Resource exhaustion from an expensive Cypher query, which is a capacity question rather than a defect
  • An instance deliberately started with authentication disabled or with an administrative account handed out, which is a configuration decision
  • Findings against a version line the vendor no longer supports

Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2026-14587 Medium 5.5 5 Aug 2026
CVE-2026-1471 Low 2.1 11 Mar 2026
CVE-2026-1524 Low 2.1 11 Mar 2026
CVE-2026-1497 Low 2.0 11 Mar 2026
CVE-2026-1337 Low 1.1 6 Feb 2026
CVE-2024-34517 Medium 6.5 7 May 2024
CVE-2023-23926 Medium 5.9 16 Feb 2023
CVE-2022-23532 High 7.1 14 Jan 2023
CVE-2022-37423 High 7.5 12 Aug 2022
CVE-2021-42767 Critical 9.1 1 Mar 2022
CVE-2021-34371 Critical 9.8 5 Aug 2021
CVE-2021-34802 High 8.8 30 Jul 2021
CVE-2018-1000820 Critical 10.0 20 Dec 2018
CVE-2018-18389 Critical 9.8 16 Oct 2018
CVE-2013-7259 Medium 6.8 29 Apr 2014

Original policy

Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 7 Last 12 months 12 Lifetime Access control and privilege escalation 35 % Injection and procedure execution 30 % Path and import handling 20 % Info disclosure 15 % Latest advisories Loading the feed Overview Neo4j is the dominant property-graph database, and Community Edition is the build that ships in the Docker image, the Debian and RPM packages and a long tail of appliance images under enterprise knowledge graphs, fraud detection and a fast-growing amount of GraphRAG. A graph database concentrates the relationships that every other system keeps scattered, so a read past the authorization boundary hands over the map rather than a row. The vendor runs a mature process and curates its own CVE records as a CNA. It also states on its trust centre that there is no bug bounty and that compensation claims will be refused, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The trust-centre policy takes vulnerability reports on Neo4j products through its responsible-disclosure process and offers acknowledgement in place of money. It publishes no narrow asset list for the database itself, so the Community Edition tree is the target and nothing inside it is carved out The Bolt protocol server: the handshake, the authentication exchange, message framing and everything a client can send before it is authenticated The HTTP API and the bundled Neo4j Browser, including the endpoints the browser calls on an operator's behalf Cypher parsing and execution in full, covering parameters, procedure and function invocation, subqueries and dynamic query construction Authentication and authorization: native auth, password storage and reset, session and token handling, and the role and privilege checks behind every operation User-defined procedures and functions, the plugin loading path, and the settings that decide which procedures an unprivileged user may call The procedure sandbox and any path from a callable procedure to the JVM, the filesystem or an outbound network request Import and export handling: LOAD CSV , the configured import directory and the setting meant to confine reads to it, plus any path that fetches a URL a caller supplied The administration tooling that ships with the distribution, covering neo4j-admin , dump and load, backup and restore, and the files they read Configuration parsing and the defaults a server runs with when an operator changes nothing Logging and the query log, including what a credential or a parameter value looks like once it has been written down The embedded library use, where Neo4j runs inside another JVM application rather than as a server Out of scope Enterprise Edition features, which are commercial rather than part of the open-source target here, even though the vendor's own process accepts reports on them Language drivers maintained in their own repositories, where the defect is in the driver rather than the server Third-party procedure libraries and plugins that do not ship with the distribution An instance deliberately started with authentication disabled or with an administrative account handed out, which is a configuration decision Resource exhaustion from an expensive Cypher query, which is a capacity question rather than a defect Findings against a version line the vendor no longer supports Most-valued findings Anything that escapes the procedure sandbox into arbitrary JVM code, filesystem access or an outbound request. This is the highest-value class on any graph database that lets stored procedures run Privilege escalation from an ordinary user to an administrative one, or any authorization check that a Cypher query can route around by reaching data through a relationship rather than a direct match Cypher injection where a parameter, a label or a property name becomes syntax, particularly inside a procedure that builds a query string from its arguments Authentication bypass on Bolt or HTTP, including anything acted on before the credential is verified and anything that survives a password change or a role revocation Import and export paths escaping the configured import directory, and server-side request forgery where the database fetches a URL a caller controls Deserialization anywhere on a protocol path, since Bolt and the HTTP endpoints both decode structured input from callers Information disclosure through the browser endpoint, the management surface or the logs, where credentials or another tenant's query text becomes readable Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through the responsible-disclosure process on the Neo4j trust centre. The organisation SECURITY.md routes there, and the live security.txt carries the policy URL, an acknowledgments URL and a PGP fingerprint Encrypt with the published PGP key where the finding warrants it. The key is advertised in the security.txt alongside the policy Say which edition you tested. Community Edition is the open-source build and the target here, and several authorization features exist only in the commercial edition Neo4j is a CNA and assigns its own CVE records, with a documented process for disputing one. Read the record it publishes for your finding rather than assuming a third party will assign it Include the Cypher that reproduces it, the procedure allow-list and sandbox settings in force, and any plugin that was loaded, since most of this surface depends on server configuration The trust centre states that claims of compensation will not be accepted. There is no reward to negotiate, only a public acknowledgment Disclosure Coordinated through the vendor's trust-centre process and published under Neo4j's own CNA, which means the CVE record and the advisory come from the vendor rather than from a GitHub advisory feed. Reporters are credited on a public acknowledgments list. No fixed embargo length is published, so plan for a hold that runs to a patched release across the supported version lines, and use the documented dispute process if the published record misstates your finding. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability