CVE-2026-35402: mcp-neo4j-cypher - SSRF and Data Modification via read_only Mode Bypass
Summary
CVE-2026-35402: Neo4j Labs MCP Servers: SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures. Affects mcp-neo4j-cypher versions < 0.6.0. Fixed in 0.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mcp-neo4j-cypher is a package designed for interacting with Neo4j databases using Cypher queries. It provides a set of procedures that enhance the capabilities of Neo4j, allowing for more complex data manipulations and queries. However, certain versions of this package prior to 0.6.0 have a critical vulnerability that allows unauthorized data modifications, undermining the intended read-only mode functionality.
Vulnerability Detail
The vulnerability arises from a flaw in the enforcement of the 'read_only' mode in mcp-neo4j-cypher versions before 0.6.0. Attackers can exploit this flaw by using specific APOC procedures to bypass the read-only restrictions, leading to potential server-side request forgery (SSRF) and unauthorized data modifications. The impact of this vulnerability can vary based on the system's configuration and the presence of other accessible systems in the environment.
How To Fix
Minimum fixed version
0.6.0
This is the first release that contains the fix.
pip install --upgrade "mcp-neo4j-cypher==0.6.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, limit the use of APOC procedures to only those that are necessary for your application. Additionally, manage data loading privileges carefully by following the guidelines in the Neo4j documentation. Ensure that 'apoc.import.file.enabled' is set to 'false' and 'apoc.import.file.use_neo4j_config' is set to 'true' to restrict file imports.
Conclusion
The vulnerability in mcp-neo4j-cypher allows for unauthorized data modifications due to a bypass of the read_only mode. It is crucial to update to version 0.6.0 or later to mitigate this risk. Implementing the recommended workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for mcp-neo4j-cypher →
FAQ
The CVSS score of this vulnerability is 2.3, indicating a low severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
APOC procedures are a set of utilities that extend the functionality of Neo4j, allowing for advanced data manipulation and querying capabilities.
If you cannot update the package immediately, implement the recommended workarounds to limit the exposure of your system to this vulnerability.
The vulnerability was discovered by Yotam Perkal from Pluto Security.
References
Related vulnerabilities
Recent vulnerabilities recorded for mcp-neo4j-cypher.
