CVE-2026-35402: Neo4j Labs MCP Servers SSRF And Data Modification Vulnerability

LOW
Advisory Identifier: GHSA-x3cv-r3g3-fpg9
Share
CWE-284
Published
Advisory Summary

CVE-2026-35402 is a LOW ssrf and data modification vulnerability (CWE-284: Improper Access Control) affecting Neo4j Labs MCP Servers libraries in the PyPI ecosystem. The issue involves ssrf and data modification via read_only mode bypass through call procedures. Remediation is available by upgrading affected packages to version 0.6.0.

CVE-2026-35402 at a Glance

CVE Identifier CVE-2026-35402
GHSA Identifier GHSA-x3cv-r3g3-fpg9
Severity LOW
CVSS v3.1 Base Score N/A
CWE Classification CWE-284: Improper Access Control
Affected Product Neo4j Labs MCP Servers
Package Ecosystem PyPI
Published Date
Last Updated

How to Fix CVE-2026-35402

To remediate this vulnerability, upgrade all affected Neo4j Labs MCP Servers dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

mcp-neo4j-cypher fixed: 0.6.0 
pip install mcp-neo4j-cypher>=0.6.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show mcp-neo4j-cypher

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2026-35402, inspect your installed packages using pip:

pip show mcp-neo4j-cypher

Analyze the terminal output to locate any version of Neo4j Labs MCP Servers in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.6.0), your application is affected.

Note: The pip show mcp-neo4j-cypher command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-284: Improper Access Control, where the product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. In Neo4j Labs MCP Servers, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary The `read_only` mode in `mcp-neo4j-cypher` versions prior to 0.6.0 can be bypassed using `CALL` procedures. ### Details #### Impact The enforcing of `read_only` mode in vulnerable versions could be bypassed by certain APOC procedures. #### Patches v0.6.0 release hardened the checks around the mode. The only way to guarantee the server actions is to limit the permissions of the db credentials available to the server. ### Notes Impacts for server-side request forgery vulnerabilities may depend on both the configuration of the vulnerable system as well as the presence of other systems in the environment that could be accessed as part of exploitation. #### Recommended hardening - Limit the apoc procedures to what's required - [Manage data loading privileges](https://neo4j.com/docs/operations-manual/current/authentication-authorization/load-privileges/ ) - Don't relax the default settings without compensating controls - `apoc.import.file.enabled` is `false` by default - `apoc.import.file.use_neo4j_config` is `true` by default to restrict file imports to the import folder ### Credits We want to publicly recognise the contribution of [Yotam Perkal](https://github.com/yotampe-pluto) from [Pluto Security](https://pluto.security/).

CVE-2026-35402 Affected Neo4j Labs MCP Servers Versions

1 component(s)
Fixed Versions:
0.6.0
Product / Package Ecosystem Affected Versions Fixed Version
mcp-neo4j-cypher
pypi/mcp-neo4j-cypher
PyPI
< 0.6.0
0.6.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/neo4j-contrib/mcp-neo4j/security/advisories/GHSA-x3cv-r3g3-fpg9
NVD — CVE-2026-35402 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-35402
Neo4j Labs MCP Servers Source Repository REPOSITORY
https://github.com/neo4j-contrib/mcp-neo4j
Neo4j Labs MCP Servers Release RELEASE
https://github.com/neo4j-contrib/mcp-neo4j/releases/tag/mcp-neo4j-cypher-v0.6.0

Frequently Asked Questions

What is CVE-2026-35402?
CVE-2026-35402 is a security vulnerability in Neo4j Labs MCP Servers involving SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures under CWE-284: Improper Access Control.
Which Neo4j Labs MCP Servers versions are affected?
Affected versions include releases prior to 0.6.0 across affected packages: mcp-neo4j-cypher.
What version fixes CVE-2026-35402?
Upgrading to 0.6.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is mcp-neo4j-cypher affected?
Yes, mcp-neo4j-cypher is affected in releases prior to 0.6.0. Upgrade your dependency to 0.6.0 or later.
What CWE is associated with CVE-2026-35402?
CVE-2026-35402 is classified under CWE-284: Improper Access Control (The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.).
How can I check PyPI dependencies for CVE-2026-35402?
Run the dependency tree command: 'pip show mcp-neo4j-cypher'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x3cv-r3g3-fpg9",
  "modified" : "2026-04-24T20:48:20Z",
  "published" : "2026-04-17T21:30:50Z",
  "aliases" : [ "CVE-2026-35402" ],
  "summary" : "Neo4j Labs MCP Servers: SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures",
  "details" : "### Summary\nThe `read_only` mode in `mcp-neo4j-cypher` versions prior to 0.6.0 can be bypassed using `CALL` procedures. \n### Details\n\n#### Impact\nThe enforcing of `read_only` mode in vulnerable versions could be bypassed by certain APOC procedures.\n\n#### Patches\nv0.6.0 release hardened the checks around the mode. The only way to guarantee the server actions is to limit the permissions of the db credentials available to the server.\n\n### Notes\nImpacts for server-side request forgery vulnerabilities may depend on both the configuration of the vulnerable system as well as the presence of other systems in the environment that could be accessed as part of exploitation.\n#### Recommended hardening\n\n- Limit the apoc procedures to what's required\n- [Manage data loading privileges](https://neo4j.com/docs/operations-manual/current/authentication-authorization/load-privileges/ )\n- Don't relax the default settings without compensating controls\n    - `apoc.import.file.enabled` is `false` by default\n    - `apoc.import.file.use_neo4j_config` is `true` by default to restrict file imports to the import folder\n\n### Credits\nWe want to publicly recognise the contribution of [Yotam Perkal](https://github.com/yotampe-pluto) from [Pluto Security](https://pluto.security/).",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "mcp-neo4j-cypher"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.6.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/neo4j-contrib/mcp-neo4j/security/advisories/GHSA-x3cv-r3g3-fpg9"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-35402"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/neo4j-contrib/mcp-neo4j"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/neo4j-contrib/mcp-neo4j/releases/tag/mcp-neo4j-cypher-v0.6.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-284" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-17T21:30:50Z",
    "nvd_published_at" : "2026-04-17T21:16:33Z"
  }
}