mcp-neo4j-cypher vulnerabilities
CVEs whose affected-version data names the mcp-neo4j-cypher package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-35402LowNeo4j Labs MCP Servers: SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures
Neo4j Labs MCP Servers: SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures
▾ Sunlitmcp-neo4j-cypher · mcp-neo4j-cypherEPSS 0.39%via OSV
CVE-2025-10193HighNeo4j Cypher MCP server is vulnerable to DNS rebinding
Neo4j Cypher MCP server is vulnerable to DNS rebinding
▾ Twilightmcp-neo4j-cypher · mcp-neo4j-cypherEPSS 0.22%via OSV