Neo4j Cypher MCP server is vulnerable to DNS rebinding
Impact
DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed.
Patches
CORS Middleware added to Cypher MCP server v0.4.0 that blocks all web-based access by default.
Workarounds
If you cannot upgrade to v0.4.0 and above, use stdio mode.
References
Vendor Advisory https://www.cve.org/CVERecord?id=CVE-2025-10193
Credits We want to publicly recognize the contribution of Evan Harris from mcpsec.dev for reporting this issue and following the responsible disclosure policy.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | mcp-neo4j-cypher | >= 0.2.2, < 0.4.0 | 0.4.0 |
References
- https://github.com/neo4j-contrib/mcp-neo4j/security/advisories/GHSA-vcqx-v2mg-7chx
- https://nvd.nist.gov/vuln/detail/CVE-2025-10193
- https://github.com/neo4j-contrib/mcp-neo4j/pull/165
- https://github.com/neo4j-contrib/mcp-neo4j/commit/5b9fbdda6401668d7aa006daf7e644805c067c15
- https://github.com/neo4j-contrib/mcp-neo4j
- https://github.com/neo4j-contrib/mcp-neo4j/releases/tag/mcp-neo4j-cypher-v0.4.0
- https://neo4j.com/security/cve-2025-10193
- https://pypi.org/project/mcp-neo4j-cypher
- https://github.com/advisories/GHSA-vcqx-v2mg-7chx
- CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-346- Platform
- Python (PyPI)
- Package
mcp-neo4j-cypher- Disclosed
- 11.09.2025
- Updated
- 11.10.2026 13:19
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1620 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-vcqx-v2mg-7chx - CC BY 4.0
Vulnerability history: mcp-neo4j-cypher
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 09.2025 04.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Low 1
Disclosures per year
- 2025: 1
- 2026: 1
-
Neo4j Cypher MCP server is vulnerable to DNS rebinding this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.