github - ghsa-vcqx-v2mg-7chx

ghsa-vcqx-v2mg-7chx

Vulnerability from github

Published

2025-09-11 23:26

Modified

2025-09-11 23:26

Severity ?

7.4 (High) - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

Neo4j Cypher MCP server is vulnerable to DNS rebinding

Details

Impact

DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed.

Patches

CORS Middleware added to Cypher MCP server v0.4.0 that blocks all web-based access by default.

Workarounds

If you cannot upgrade to v0.4.0 and above, use stdio mode.

References

Vendor Advisory https://www.cve.org/CVERecord?id=CVE-2025-10193

Credits We want to publicly recognize the contribution of Evan Harris from mcpsec.dev for reporting this issue and following the responsible disclosure policy.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mcp-neo4j-cypher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.2.2"
            },
            {
              "fixed": "0.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-10193"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-11T23:26:00Z",
    "nvd_published_at": "2025-09-11T14:15:40Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nDNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances.\u0026nbsp;The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed.\n\n### Patches\nCORS Middleware added to Cypher MCP server v0.4.0 that blocks all web-based access by default.\n\n### Workarounds\nIf you cannot upgrade to v0.4.0 and above, use stdio mode.\n\n### References\n[Vendor Advisory](https://neo4j.com/security/cve-2025-10193)\nhttps://www.cve.org/CVERecord?id=CVE-2025-10193 \n\nCredits\nWe want to publicly recognize the contribution of Evan Harris from [mcpsec.dev](https://mcpsec.dev/) for reporting this issue and following the responsible disclosure [policy](https://neo4j.com/trust-center/responsible-disclosure/).",
  "id": "GHSA-vcqx-v2mg-7chx",
  "modified": "2025-09-11T23:26:00Z",
  "published": "2025-09-11T23:26:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/neo4j-contrib/mcp-neo4j/security/advisories/GHSA-vcqx-v2mg-7chx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10193"
    },
    {
      "type": "WEB",
      "url": "https://github.com/neo4j-contrib/mcp-neo4j/pull/165"
    },
    {
      "type": "WEB",
      "url": "https://github.com/neo4j-contrib/mcp-neo4j/commit/5b9fbdda6401668d7aa006daf7e644805c067c15"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/neo4j-contrib/mcp-neo4j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/neo4j-contrib/mcp-neo4j/releases/tag/mcp-neo4j-cypher-v0.4.0"
    },
    {
      "type": "WEB",
      "url": "https://neo4j.com/security/cve-2025-10193"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": " Neo4j Cypher MCP server is vulnerable to DNS rebinding "
}

CVE-2025-10193 (GCVE-0-2025-10193)

Vulnerability from cvelistv5

Published

2025-09-11 14:05

Modified

2025-09-12 03:56

Severity ?

7.4 (High) - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/V:D/RE:L/U:Amber

CWE

CWE-346 - Origin Validation Error

Summary

References

▼	URL	Tags
	https://neo4j.com/security/cve-2025-10193	vendor-advisory
	https://github.com/neo4j-contrib/mcp-neo4j/security/advisories/GHSA-vcqx-v2mg-7chx	third-party-advisory
	https://github.com/neo4j-contrib/mcp-neo4j/releases/tag/mcp-neo4j-cypher-v0.4.0	release-notes

Impacted products

	Vendor	Product	Version
	neo4j	neo4j-cypher MCP server	Version: 0.2.2 ≤ 0.3.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-10193",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-11T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-12T03:56:13.888Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.python.org",
          "defaultStatus": "unaffected",
          "packageName": "mcp-neo4j-cypher",
          "product": "neo4j-cypher MCP server",
          "repo": "https://github.com/neo4j-contrib/mcp-neo4j",
          "vendor": "neo4j",
          "versions": [
            {
              "lessThanOrEqual": "0.3.1",
              "status": "affected",
              "version": "0.2.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Evan Harris"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances.\u0026nbsp;The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances.\u00a0The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-54",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-54 Query System for Information"
            }
          ]
        },
        {
          "capecId": "CAPEC-275",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-275 DNS Rebinding"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "DIFFUSE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/V:D/RE:L/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "LOW"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346 Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-11T14:09:53.951Z",
        "orgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6",
        "shortName": "Neo4j"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://neo4j.com/security/cve-2025-10193"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/neo4j-contrib/mcp-neo4j/security/advisories/GHSA-vcqx-v2mg-7chx"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/neo4j-contrib/mcp-neo4j/releases/tag/mcp-neo4j-cypher-v0.4.0"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This issue is fixed in v0.4.0 and all later versions."
            }
          ],
          "value": "This issue is fixed in v0.4.0 and all later versions."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Neo4j Cypher MCP server is vulnerable to DNS rebinding attacks",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use stdio mode if you cannot upgrade to v0.4.0 and above."
            }
          ],
          "value": "Use stdio mode if you cannot upgrade to v0.4.0 and above."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6",
    "assignerShortName": "Neo4j",
    "cveId": "CVE-2025-10193",
    "datePublished": "2025-09-11T14:05:30.592Z",
    "dateReserved": "2025-09-09T16:04:09.860Z",
    "dateUpdated": "2025-09-12T03:56:13.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-vcqx-v2mg-7chx

Vulnerability from github

Impact

Patches

Workarounds

References

CVE-2025-10193 (GCVE-0-2025-10193)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature