CVE-2025-10193

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-10193
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-10193.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-10193
Aliases
Published
2025-09-11T14:05:30Z
Modified
2026-08-12T03:51:21Z
Severity
  • 7.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/V:D/RE:L/U:Amber CVSS Calculator
Summary
Neo4j Cypher MCP server is vulnerable to DNS rebinding attacks
Details

DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed.

Database specific 
{
    "cna_assigner": "Neo4j",
    "cwe_ids": [
        "CWE-346"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10193.json"
}
References

Affected packages

Git / github.com/neo4j-contrib/mcp-neo4j

Affected ranges

Type
GIT
Repo
https://github.com/neo4j-contrib/mcp-neo4j
Events
Introduced
3ccc3ff76763a3cdce3f389bff67339b1fac32c1
Last Affected
deba7fe51242925bab7d3b373a08d3985991d402
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.2.2"
        },
        {
            "last_affected": "0.3.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

mcp-neo4j-aura-manager-v0.*
mcp-neo4j-aura-manager-v0.3.0
mcp-neo4j-cypher-v0.*
mcp-neo4j-cypher-v0.2.2
mcp-neo4j-cypher-v0.2.3
mcp-neo4j-cypher-v0.2.4
mcp-neo4j-cypher-v0.2.4-dxt
mcp-neo4j-cypher-v0.3.0
mcp-neo4j-cypher-v0.3.1
mcp-neo4j-data-modeling-v0.*
mcp-neo4j-data-modeling-v0.1.0
mcp-neo4j-data-modeling-v0.1.1
mcp-neo4j-data-modeling-v0.2.0
mcp-neo4j-data-modeling-v0.3.0
mcp-neo4j-memory-v0.*
mcp-neo4j-memory-v0.1.5
mcp-neo4j-memory-v0.2.0
mcp-neo4j-memory-v0.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-10193.json"