- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 0
- Public CVEs
- 15
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
Neo4j is currently not running an active bug bounty program, so claims of compensation for reporting will not be accepted.
- Safe harbor
-
Partial
Don’t break any applicable laws or regulations
- Hall of fame
-
Yes
we will offer to credit your finding on a public list of acknowledgments
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
0 assets you may test, 33 excluded.
Self-hosted does not list the scope of this program publicly. Check its policy.
Out of scope (33)
- Account enumeration attacks
- Any issues related to credential stuffing and account takeover
- Any other submissions determined to be low risk, based on unlikely hypothetical attack vectors, requiring significant user interaction, or resulting in minimal impact
- Attacks targeting outdated or obscure browsers
- Attacks that rely on presenting the user with fake UI that is visually identical to Neo4j UI
- Best practices deviation (password complexity, expiration, re-use etc)
- Bugs that do not represent security risk
- Bypassing rate limits or the non-existence of rate limits that have no platform impact (don’t execute DoS to “prove” impact!)
- Clickjacking on pre-authenticated pages and missing anti-clickjacking headers
- Clickjacking on pre-authenticated pages, lack of anti-clickjacking headers, or other non-exploitable clickjacking issues
- Content spoofing and text injection issues without being able to modify HTML/CSS
- Credential stuffing and account takeover
- CSRF with no security impact
- CSRF with no security impact (unathenticated/login/logout CSRF)
- Deviation from best practices, information disclosures, verbose or unique error pages, stack traces (without substantive proof of concept of exploitability)
- Exposure of internal domains on public domains
- Hardcoded API keys in applications (without substantive demonstration of significant risk)
- Homograph links
- HTTP TRACE or OPTIONS methods enabled
- Insecure cookie settings/flags on non-sensitive cookies
- Insecure cookie settings or flags on non-sensitive cookies
- Issues only affecting outdated, unpatched or non-default installations
- Known vulnerable libraries without a novel and working Proof of Concept
- Lack of security-related headers
- Opinions on design/architecture
- Out of date software or libraries
- Reflected file download
- Self-XSS and issues exploitable only through self-XSS
- Spam or social engineering techniques
- Vulnerabilities only affecting users of outdated or unpatched versions, or installations where the configuration is weakened from the default out of the box options
- Vulnerabilities requiring physical access to the victim’s unlocked computer or device; pre-existing root/system privileges or MITM on the victim’s computer or device
- Weak SSL/TLS algorithms, protocols or cyphers
- Weak SSL/TLS algorithms, protocols, or cyphers
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Neo4j's policy. "We" in these lines means the program, not this site.
While testing
-
Don’t break any applicable laws or regulations
-
Don’t exploit potential vulnerabilities to access restricted information
-
Don’t modify or remove information
-
Don’t use high-intensity invasive or destructive scanning tools to find vulnerabilities
-
Don’t affect the availability by denial of service attacks
-
Don’t submit trivial issues (see examples below
-
Don’t execute social engineering, phishing, or similar attacks targeting Neo4j personnel and/or customers
-
Report any found potential vulnerabilities to us first, and allow us time to evaluate and mitigate before going public with it
Not accepted
-
Account enumeration attacks
-
Attacks targeting outdated or obscure browsers
-
Insecure cookie settings/flags on non-sensitive cookies
-
Weak SSL/TLS algorithms, protocols, or cyphers
-
CSRF with no security impact (unathenticated/login/logout CSRF)
-
Best practices deviation (password complexity, expiration, re-use etc)
-
Clickjacking on pre-authenticated pages, lack of anti-clickjacking headers, or other non-exploitable clickjacking issues
-
Known vulnerable libraries without a novel and working Proof of Concept
-
Reflected file download
-
Content spoofing and text injection issues without being able to modify HTML/CSS
-
Homograph links
-
Exposure of internal domains on public domains
-
Out of date software or libraries
-
Any issues related to credential stuffing and account takeover
-
Spam or social engineering techniques
-
HTTP TRACE or OPTIONS methods enabled
-
Lack of security-related headers
-
Self-XSS and issues exploitable only through self-XSS
-
Bugs that do not represent security risk
-
Opinions on design/architecture
-
Hardcoded API keys in applications (without substantive demonstration of significant risk)
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-14587 | Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for more bytes instead of rejecting the protocol message and closing the channel. Because the same unread byt | Medium 5.5 | 5 Aug 2026 |
| CVE-2026-1471 | Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint). We recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed. | Low 2.1 | 11 Mar 2026 |
| CVE-2026-1524 | An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provid | Low 2.1 | 11 Mar 2026 |
| CVE-2026-1497 | Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any local database or remote alias called "name". If such database or alias doesn't exist when the command is | Low 2.0 | 11 Mar 2026 |
| CVE-2026-1337 | Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01. Proof of concept exploit: https://github.co | Low 1.1 | 6 Feb 2026 |
| CVE-2024-34517 | The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access. | Medium 6.5 | 7 May 2024 |
| CVE-2023-23926 | APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin prior to version 5.5.0 and 4.4.0.14 (4.4 branch) in Neo4j graph database. XML External Entity (XXE) injection occurs when the XML parser allows external entities to be resolved. The XML parser used by the apoc.import.graphml p | Medium 5.9 | 16 Feb 2023 |
| CVE-2022-23532 | APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j that provides hundreds of procedures and functions. A path traversal vulnerability found in the apoc.export.* procedures of apoc plugins in Neo4j Graph database. The issue allows a malicious actor to potentially break out of the expected directory. The vulnerability is such that files could only be created but not overwritten. For | High 7.1 | 14 Jan 2023 |
| CVE-2022-37423 | Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.log.stream. | High 7.5 | 12 Aug 2022 |
| CVE-2021-42767 | A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1. | Critical 9.1 | 1 Mar 2022 |
| CVE-2021-34371 | Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains. | Critical 9.8 | 5 Aug 2021 |
| CVE-2021-34802 | A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow authenticated users to execute commands with elevated privileges. | High 8.8 | 30 Jul 2021 |
| CVE-2018-1000820 | neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after commit 45bc09c. | Critical 10.0 | 20 Dec 2018 |
| CVE-2018-18389 | Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password. | Critical 9.8 | 16 Oct 2018 |
| CVE-2013-7259 | Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to (1) db/data/ext/GremlinPlugin/graphdb/execute_script or (2) db/manage/server/console/. | Medium 6.8 | 29 Apr 2014 |