Vulnerability	Vulnerable Version
M Insertion of Sensitive Information into Log File Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the `obfuscate_literals` option in query logging. An attacker can access sensitive information by reading unredacted error data in the query logs when queries fail. Notes: This is only exploitable if the attacker has legitimate access to the local log files and can execute queries that trigger errors. If your configuration had `db.logs.query.obfuscate_literals` enabled, and you wish the obfuscation to cover the error messages as well, you need to enable the new configuration setting `db.logs.query.obfuscate_errors` once you have upgraded Neo4j. How to fix Insertion of Sensitive Information into Log File? Upgrade `org.neo4j:neo4j-configuration` to version 5.26.21, 2026.01.3 or higher.	[,5.26.21)[2025.01.0,2026.01.3)

Insertion of Sensitive Information into Log File

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the obfuscate_literals option in query logging. An attacker can access sensitive information by reading unredacted error data in the query logs when queries fail.

Notes:

This is only exploitable if the attacker has legitimate access to the local log files and can execute queries that trigger errors.

If your configuration had db.logs.query.obfuscate_literals enabled, and you wish the obfuscation to cover the error messages as well, you need to enable the new configuration setting db.logs.query.obfuscate_errors once you have upgraded Neo4j.

How to fix Insertion of Sensitive Information into Log File?

Upgrade org.neo4j:neo4j-configuration to version 5.26.21, 2026.01.3 or higher.

[,5.26.21)[2025.01.0,2026.01.3)

Go back to all versions of this package