CVE-2025-10193: Neo4j Cypher MCP server is vulnerable to DNS rebinding attacks
Impact DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed.
Patches CORS Middleware added to Cypher MCP server v0.4.0 that blocks all web-based access by default.
Workarounds If you cannot upgrade to v0.4.0 and above, use stdio mode.
References Vendor Advisory https://www.cve.org/CVERecord?id=CVE-2025-10193
Credits We want to publicly recognize the contribution of Evan Harris from mcpsec.dev for reporting this issue and following the responsible disclosure policy.
Other sources
DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10193?
CVE-2025-10193 is rated as a high-severity vulnerability due to its potential to allow unauthorized access to Neo4j MCP instances.
How can I fix CVE-2025-10193?
To fix CVE-2025-10193, ensure you update your Neo4j Cypher MCP server to the latest patched version.
What does CVE-2025-10193 exploit?
CVE-2025-10193 exploits the DNS rebinding vulnerability to bypass Same-Origin Policy protections.
Who is affected by CVE-2025-10193?
The vulnerability affects users running Neo4j Cypher MCP server instances.
What are the potential impacts of CVE-2025-10193?
The potential impacts of CVE-2025-10193 include unauthorized tool invocations against locally running Neo4j MCP instances.