# MCP Neo4j Unauthenticated Cypher Abuse

- **Severity:** High
- **Signature ID:** `7f3c9b1e-4a52-4d6f-9c08-2b1e5a7d3c94`
- **CVEs:** CVE-2025-56406
- **OWASP:** LLM02 (Sensitive Information Disclosure), ASI02 (Tool Misuse and Exploitation)

## Summary

A known flaw in mcp-neo4j version 0.3.0 lets anyone reach its SSE/JSON-RPC interface without logging in and run Cypher queries. Attackers use this to read files off the server, dump configuration and user accounts, or create new privileged database users.

## How the attack works

The attacker sends a request to the exposed mcp-neo4j SSE/JSON-RPC endpoint without any authentication. The request body contains both a marker showing it targets the Neo4j MCP surface and a Cypher/APOC call that has no legitimate purpose other than abuse — for example reading files from disk, dynamically evaluating Cypher, listing server configuration and users, or creating a new account. The rule flags this combination in a single request as the exploitation attempt itself, since it only sees the payload text, not what happens on the server afterward.

## Why it matters

A successful attack can expose files, database configuration, and user credentials from the Neo4j server, or hand the attacker a new privileged account — all without needing to authenticate first.

## What you can do

- Upgrade mcp-neo4j past version 0.3.0 or apply the vendor's fix for CVE-2025-56406.
- Do not expose the mcp-neo4j SSE/JSON-RPC endpoint to untrusted networks; require authentication in front of it.
- Review any alerts involving apoc.import.csv, apoc.export.*, dbms.listConfig(), or SHOW USERS to confirm they come from known, authorized ETL jobs or admin activity.
- Audit Neo4j user accounts for any unexpected or recently created privileged users.

## Known benign look-alikes

- Authorised data-engineering runs where an agent uses apoc.import.csv or apoc.export.* against a local staging path during a genuine ETL job. These fire on sel_cypher_file_read. This is the single largest residual FP source and is the reason the action is report.
- A Neo4j administrator legitimately auditing configuration through an MCP agent with CALL dbms.listConfig() or SHOW USERS. Genuine but privileged, and worth a record.
- Novel security research or an internal runbook pasted into an agent conversation that quotes APOC exploitation payloads without carrying a CVE identifier or the words advisory/proof-of-concept, so filter_security_docs does not catch it.
- mcp-neo4j's own test suite and CI fixtures, mitigated by filter_test_fixture.
- MCP tools/list responses whose tool descriptions mention APOC procedures, mitigated by filter_mcp_discovery, and dbms.procedures()/SHOW PROCEDURES catalog output, mitigated by filter_procedure_catalog.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2025-56406
- https://attack.mitre.org/techniques/T1190/
- https://attack.mitre.org/techniques/T1059/

---
Source: https://www.netzilo.com/threats/mcp-neo4j-unauth-cypher-abuse