IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-09-11 14:15

MODIFIED

2025-09-11 17:14

EPSS (Prob. Exploit)

0.22%

Top 87.3%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-vcqx-v2mg-7chx HIGH

Neo4j Cypher MCP server is vulnerable to DNS rebinding

AFFECTED PACKAGES:

PIP / mcp-neo4j-cypher

>= 0.2.2, < 0.4.0

Fixed in: 0.4.0

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Neo4j Cypher MCP server is vulnerable to DNS rebinding attacks

AFFECTED PACKAGES:

Unknown / Unknown

14 versions affected

ALIASES:

GHSA-vcqx-v2mg-7chx, PYSEC-2026-1620

> HISTORIQUE DES MODIFICATIONS

Première apparition

11/09/2025 14:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:08

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui