Description (CNA)
DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| neo4j / neo4j-cypher MCP server | affected 0.2.2 through 0.3.1 |
CWE
CWE-346
References
- https://neo4j.com/security/cve-2025-10193
- https://github.com/neo4j-contrib/mcp-neo4j/security/advisories/GHSA-vcqx-v2mg-7chx
- https://github.com/neo4j-contrib/mcp-neo4j/releases/tag/mcp-neo4j-cypher-v0.4.0
ADP enrichment
No English description supplied.
No references supplied.