Namespace Access Issue in Neo4j Enterprise Edition

CVE-2026-1497

What is CVE-2026-1497?

In the Neo4j Enterprise Edition, a flaw in the resolution of namespaces within composite databases allows an administrator to inadvertently grant access permissions to unintended local databases or remote aliases. If an admin attempts to provide access to a specific database constituent identified as 'namespace.name', they may unknowingly permit access to any local database or remote alias named 'name'. If such a database or alias does not exist at the time of the command execution, the privileges will extend to any future creation of a database or alias that matches this name convention.

References