CVSS 4.0
7.4 highCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/V:D/RE:L/U:AmberCVE-2025-10193
High (7.4). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in mcp-neo4j-cypher 0.4.0.
DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
- CWE
- CWE-346
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vcqx-v2mg-7chx | PyPI | mcp-neo4j-cypher | >=0.2.2 <0.4.0 | 0.4.0 |
| PYSEC-2026-1620 | PyPI | mcp-neo4j-cypher | >=0.2.2 <0.4.0 | 0.4.0 |