VULNERABILITY INTELLIGENCE
CVE-2025-10193
CVSS score7.4 HIGH
EPSS probability0.22%
CISA KEVNot currently listed
Published2025-09-11
Last modified2026-06-17
CVSS vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/V:D/RE:L/U:Amber
Description
DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances. The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed.
Weakness classification
- CWE-346: Origin Validation Error