CVE-2025-10193: NEO4J NEO4J-Cypher Mcp Server

High severity, CVSS 7.4. EPSS: 0.2% chance of exploitation in the next 30 days.

DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed.

Affected products

• NEO4J NEO4J-Cypher Mcp Server: from 0.2.2, up to and including 0.3.1

Published 2025-09-11. Last modified 2026-06-17.