The vulnerability resides in mcp-neo4j-cypher, an MCP server that executes Cypher queries for Neo4j databases. In versions prior to 0.6.0 the enforcement of read‑only mode can be bypassed by issuing APOC CALL procedures, which facilitates unauthorized write operations or server‑side request forgery. This reflects an access‑control weakness (CWE‑284) and enables an attacker to modify database content or force remote requests from the server.

The affected product is the neo4j‑contrib mcp‑neo4j MCP server, all releases earlier than version 0.6.0.

The CVSS score of 2.3 indicates a low severity impact under the current conditions. The EPSS score is not reported and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require access to the MCP server interface, typically through an exposed API or an authenticated user with permissions to execute Cypher queries. Based on the description, it is inferred that the attacker would need to send Cypher queries through the MCP server API, which is often exposed on an internal or public network. While the attack cannot be achieved remotely without such access, the presence of SSRF implies that once the read‑only bypass is achieved, the attacker can cause the server to request arbitrary URLs, potentially exfiltrating data or further compromising the network.