CVE-2026-35402: mcp-neo4j-cypher Auth Bypass Vulnerability

CVE-2026-35402 Overview

CVE-2026-35402 is an authorization bypass vulnerability in mcp-neo4j-cypher, an MCP (Model Context Protocol) server designed for executing Cypher queries against Neo4j databases. In versions prior to 0.6.0, the read_only mode enforcement can be bypassed using APOC CALL procedures, potentially allowing unauthorized write operations or server-side request forgery (SSRF).

Critical Impact

Attackers with low-privilege access can bypass read-only restrictions to perform unauthorized write operations or execute SSRF attacks against internal systems through APOC procedure abuse.

Affected Products

• mcp-neo4j-cypher versions prior to 0.6.0
• Neo4j database deployments using vulnerable mcp-neo4j-cypher MCP server
• Systems with APOC (Awesome Procedures on Cypher) extensions enabled

Discovery Timeline

• April 17, 2026 - CVE-2026-35402 published to NVD
• April 20, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35402

Vulnerability Analysis

This vulnerability falls under CWE-284 (Improper Access Control) and affects the security boundary between read-only and read-write operations in the mcp-neo4j-cypher server. The core issue stems from the server's failure to properly restrict APOC (Awesome Procedures on Cypher) CALL procedures when operating in read-only mode.

APOC is a popular Neo4j extension library that provides hundreds of useful procedures for data manipulation, integration, and system operations. When an mcp-neo4j-cypher server is configured with read_only mode, the intention is to prevent any data modification operations. However, the enforcement mechanism fails to account for APOC procedures that can perform write operations or make outbound network requests.

This allows authenticated users with limited privileges to escalate their capabilities beyond the intended read-only restrictions, potentially modifying database content or leveraging APOC's network capabilities to conduct SSRF attacks against internal infrastructure.

Root Cause

The root cause of CVE-2026-35402 is improper access control validation in the mcp-neo4j-cypher server's query parsing and execution layer. The read-only mode implementation only checks standard Cypher write operations (such as CREATE, MERGE, DELETE, SET) but fails to properly validate or restrict APOC procedure calls that can perform equivalent operations through indirect means.

The server's security boundary does not adequately distinguish between safe read-only APOC procedures and potentially dangerous ones that can modify data or initiate outbound connections. This oversight creates a bypass vector where malicious queries can use APOC procedures to circumvent the intended access restrictions.

Attack Vector

The attack leverages network-accessible mcp-neo4j-cypher servers configured in read-only mode. An attacker with authenticated access (low privilege requirement) can craft Cypher queries that invoke APOC procedures to perform operations that should be restricted.

For write operation bypass, attackers can use APOC procedures that create, modify, or delete nodes and relationships through procedure calls rather than direct Cypher statements. For SSRF attacks, APOC procedures capable of making HTTP requests (such as apoc.load.json or apoc.load.xml) can be abused to probe internal networks or interact with internal services that should not be accessible.

The exploitation requires some knowledge of available APOC procedures and the target Neo4j database schema, but does not require any user interaction and can be performed over the network.

Detection Methods for CVE-2026-35402

Indicators of Compromise

• Unexpected data modifications in Neo4j databases connected to mcp-neo4j-cypher servers configured in read-only mode
• Query logs showing APOC CALL procedure invocations from users expected to have only read access
• Outbound network connections from Neo4j or mcp-neo4j-cypher server processes to unexpected internal or external hosts
• Database audit logs indicating write operations occurring despite read-only configuration

Detection Strategies

• Implement query auditing to log all APOC procedure calls executed through mcp-neo4j-cypher servers
• Monitor Neo4j transaction logs for write operations that correlate with read-only configured MCP server sessions
• Configure network monitoring to detect SSRF attempts originating from Neo4j or MCP server infrastructure
• Review database change logs for unauthorized modifications that bypass expected access controls

Monitoring Recommendations

• Enable verbose logging on mcp-neo4j-cypher servers to capture all query executions including procedure calls
• Implement alerting on any APOC procedure calls that have write or network access capabilities
• Monitor for anomalous patterns in database operations that don't match expected read-only workloads
• Deploy network segmentation monitoring to detect SSRF attempt patterns from database infrastructure

How to Mitigate CVE-2026-35402

Immediate Actions Required

• Upgrade mcp-neo4j-cypher to version 0.6.0 or later immediately
• Audit existing deployments to identify any systems running vulnerable versions prior to 0.6.0
• Review database logs for any evidence of exploitation attempts using APOC procedure bypass
• Restrict network access to mcp-neo4j-cypher servers to trusted clients only

Patch Information

The vulnerability has been fixed in mcp-neo4j-cypher version 0.6.0. The patch implements proper validation and restriction of APOC procedure calls when operating in read-only mode. Organizations should upgrade to this version or later to remediate the vulnerability.

For detailed information about the fix, refer to the GitHub Release for mcp-neo4j-cypher v0.6.0 and the GitHub Security Advisory GHSA-x3cv-r3g3-fpg9.

Workarounds

• Disable or restrict APOC procedures at the Neo4j database level using dbms.security.procedures.unrestricted and dbms.security.procedures.allowlist configuration options
• Implement network segmentation to limit the impact of potential SSRF attacks from database infrastructure
• Use Neo4j's native role-based access control to enforce read-only restrictions at the database level rather than relying solely on mcp-neo4j-cypher
• Consider deploying a query proxy or firewall that can filter dangerous APOC procedure calls before they reach the database

# Neo4j configuration to restrict APOC procedures
# Add to neo4j.conf to limit available procedures

# Allowlist only specific safe procedures
dbms.security.procedures.allowlist=apoc.help.*,apoc.meta.*

# Disable unrestricted procedure execution
dbms.security.procedures.unrestricted=

# Restart Neo4j service after configuration changes
# systemctl restart neo4j