AI agent vulnerability · Other MCP servers and tools

CVE-2025-10193: Neo4j Cypher MCP server is vulnerable to DNS rebinding

highCVSS 4.0 7.4GHSA-vcqx-v2mg-7chx

Impact DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed.

Published Sep 11, 2025

Affected packages

mcp-neo4j-cypher

Ecosystem: PyPI
Affected: >= 0.2.2, < 0.4.0
Fixed in: 0.4.0
Check: pip show mcp-neo4j-cypher

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed.

Patches

CORS Middleware added to Cypher MCP server v0.4.0 that blocks all web-based access by default.

Workarounds

If you cannot upgrade to v0.4.0 and above, use stdio mode.

References

Vendor Advisory https://www.cve.org/CVERecord?id=CVE-2025-10193

Credits We want to publicly recognize the contribution of Evan Harris from mcpsec.dev for reporting this issue and following the responsible disclosure policy.

Credited to eharris128.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Other MCP servers and tools vulnerabilities

All Other MCP servers and tools entries