Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
mcp-neo4j-cypher is an MCP server for executing Cypher queries against Neo4j databases. In versions prior to 0.6.0, the read_only mode enforcement can be bypassed using APOC CALL procedures, potentially allowing unauthorized write operations or server-side request forgery. This issue is fixed in version 0.6.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-18 | 1 | Disclosure1 |
| 2026-04-28 | 1 | General1 |
CVE-2026-35402 mcp-neo4j-cypher is an MCP server for executing Cypher queries against Neo4j databases. In versions prior to 0.6.0, the read_only mode enforcement can be bypassed usi… https://www.cve.org/CVERecord?id=CVE-2026-35402
Post summary
The note references CVE-2026-35402, highlighting a read‑only mode enforcement bypass in mcp‑neo4j‑cypher prior to version 0.6.0, but provides no evidence of PoC, active exploitation, or patch.
CVE-2026-35402: CVE-2026-35402: Improper Access Control in mcp-neo4j-cypher via Stored Procedure Bypass CVE-2026-35402 is an improper access control vulnerability in the mcp-neo4j-cypher server. The application implements a read-only mode using a rege... https://cvereports.com/reports/CVE-2026-35402
Post summary
The post briefly describes CVE-2026-35402 as an improper access control flaw in mcp‑neo4j‑cypher through a stored procedure bypass, but lacks any PoC, exploit details, patch information, or evidence of active exploitation.