MCP Neo4j Unauthenticated Cypher Abuse

How the attack works

The attacker sends a request to the exposed mcp-neo4j SSE/JSON-RPC endpoint without any authentication. The request body contains both a marker showing it targets the Neo4j MCP surface and a Cypher/APOC call that has no legitimate purpose other than abuse — for example reading files from disk, dynamically evaluating Cypher, listing server configuration and users, or creating a new account. The rule flags this combination in a single request as the exploitation attempt itself, since it only sees the payload text, not what happens on the server afterward.

Netzilo detection

Why it matters

A successful attack can expose files, database configuration, and user credentials from the Neo4j server, or hand the attacker a new privileged account — all without needing to authenticate first.

What you can do

• →Upgrade mcp-neo4j past version 0.3.0 or apply the vendor's fix for CVE-2025-56406.
• →Do not expose the mcp-neo4j SSE/JSON-RPC endpoint to untrusted networks; require authentication in front of it.
• →Review any alerts involving apoc.import.csv, apoc.export.*, dbms.listConfig(), or SHOW USERS to confirm they come from known, authorized ETL jobs or admin activity.
• →Audit Neo4j user accounts for any unexpected or recently created privileged users.

Known benign look-alikes

• Authorised data-engineering runs where an agent uses apoc.import.csv or apoc.export.* against a local staging path during a genuine ETL job. These fire on sel_cypher_file_read. This is the single largest residual FP source and is the reason the action is report.
• A Neo4j administrator legitimately auditing configuration through an MCP agent with CALL dbms.listConfig() or SHOW USERS. Genuine but privileged, and worth a record.
• Novel security research or an internal runbook pasted into an agent conversation that quotes APOC exploitation payloads without carrying a CVE identifier or the words advisory/proof-of-concept, so filter_security_docs does not catch it.
• mcp-neo4j's own test suite and CI fixtures, mitigated by filter_test_fixture.
• MCP tools/list responses whose tool descriptions mention APOC procedures, mitigated by filter_mcp_discovery, and dbms.procedures()/SHOW PROCEDURES catalog output, mitigated by filter_procedure_catalog.

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-56406
• https://attack.mitre.org/techniques/T1190/
• https://attack.mitre.org/techniques/T1059/

Related threats