CVE-2026-35402: 
Python vulnerability analysis and mitigation

CVE-2026-35402 is a read-only mode bypass vulnerability in mcp-neo4j-cypher, an MCP (Model Context Protocol) server for executing Cypher queries against Neo4j databases. The flaw allows authenticated low-privileged attackers to bypass the read_only mode enforcement using APOC CALL procedures, potentially enabling unauthorized write operations or server-side request forgery (SSRF). It affects all versions of mcp-neo4j-cypher prior to 0.6.0 and was disclosed on April 17, 2026. The vulnerability carries a CVSS v4 base score of 2.3 (Low) (GitHub Advisory, Neo4j Security Advisory).

The root cause is improper access control (CWE-284): the read_only mode enforcement in vulnerable versions relied on a regex-based check (_is_write_query) that failed to account for APOC (Awesome Procedures on Cypher) CALL procedures, which can perform write operations and external HTTP requests. An attacker with low-level authenticated access to the MCP server can craft Cypher queries invoking APOC procedures (e.g., apoc.load.json, apoc.periodic.commit) to bypass the read-only restriction. The fix in v0.6.0 replaced the regex check with an EXPLAIN-based query analysis to more accurately determine query write intent. Exploitation requires that APOC procedures are installed and enabled on the target Neo4j instance, and that the attacker has credentials to submit queries to the MCP server (GitHub Advisory, v0.6.0 Release).

Successful exploitation allows an authenticated attacker to perform unauthorized write operations against the Neo4j database, potentially corrupting or modifying graph data that the read_only mode was intended to protect. Additionally, certain APOC procedures (e.g., apoc.load.json) can be leveraged to conduct SSRF attacks, enabling the attacker to make the server issue HTTP requests to internal or external systems — the scope of which depends on the network environment and APOC configuration. Confidentiality and integrity of both the vulnerable system and subsequent systems are rated as low impact, with no availability impact (GitHub Advisory, Neo4j Security Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been observed as of the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.05% (16th percentile), indicating a low probability of exploitation in the near term. Exploitation requires low-privilege authenticated access and the presence of APOC procedures on the target Neo4j instance, which limits the attacker pool. The vulnerability was discovered and reported by Yotam Perkal from Pluto Security (Neo4j Security Advisory).

1. Reconnaissance: Identify deployments of mcp-neo4j-cypher versions prior to 0.6.0 that are configured with read_only mode enabled and have APOC procedures installed on the backing Neo4j instance.
2. Authentication: Obtain low-privilege credentials sufficient to submit Cypher queries to the MCP server (e.g., a standard user account).
3. Bypass read-only check: Craft a Cypher query using an APOC CALL procedure that performs a write operation or external request, such as CALL apoc.periodic.commit("MATCH (n:Temp) DELETE n RETURN count(*)", {}) for data modification, or CALL apoc.load.json("http://internal-host/sensitive") for SSRF.
4. Submit the query: Send the crafted query to the MCP server's query execution endpoint; the flawed regex-based _is_write_query check fails to flag APOC CALL statements as write operations, allowing the query to execute.
5. Achieve objective: The APOC procedure executes against the Neo4j database, resulting in unauthorized data modification or an SSRF request to an internal/external resource accessible from the server (GitHub Advisory, Neo4j Security Advisory).

• Logs: Neo4j query logs containing CALL apoc.* procedures (especially apoc.load.json, apoc.periodic.commit, apoc.cypher.run) executed under a user account that should only have read access; MCP server logs showing Cypher queries with CALL statements submitted while read_only mode is enabled.
• Network: Unexpected outbound HTTP/HTTPS requests originating from the Neo4j server process to internal or external hosts, potentially indicative of SSRF via apoc.load.json or similar procedures.
• Database: Unexpected creation, modification, or deletion of nodes and relationships in the Neo4j database that should not have occurred under read-only operation; audit log entries showing write transactions from accounts restricted to read-only access.

The primary remediation is to upgrade mcp-neo4j-cypher to version 0.6.0 or later, which replaces the flawed regex-based write-query detection with an EXPLAIN-based approach (v0.6.0 Release). As a defense-in-depth measure, the advisory recommends limiting the Neo4j database credentials available to the MCP server to the minimum required privileges at the database level, which provides a guarantee independent of application-layer enforcement. Additional hardening steps include: restricting APOC procedures to only those required (apoc.import.file.enabled is false by default; keep it that way), managing data loading privileges, and not relaxing default APOC settings without compensating controls (Neo4j Security Advisory).

The vulnerability was discovered by Yotam Perkal from Pluto Security and was publicly acknowledged in the GitHub Security Advisory (Neo4j Security Advisory). Given the low CVSS score and absence of public exploit code, broader industry and social media reactions have been limited, with coverage primarily confined to automated vulnerability tracking platforms and feeds.