CVE-2026-34237

MediumCVSS 6.1

Published: 31/03/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

MCP Java SDK before versions 0.83.0, 1.0.1, and 1.1.1 has a hardcoded wildcard CORS vulnerability, allowing access from any origin.

Risk Assessment

An attacker from an external domain can perform cross-origin requests, potentially leading to data theft or CSRF attacks.

Recommendation

Update MCP Java SDK to version 0.83.0, 1.0.1, or 1.1.1 which contain the fix.

Other vulnerabilities in MCP Java SDK

CVE-2026-35568Medium
The official Java SDK for Model Context Protocol (MCP) contains a DNS rebinding vulnerability. Prior to version 1.0.0, an attacker can access a local or network-private MCP server via a victim's browser, allowing arbitrary tool calls on the server.

Original NVD description (English source)

MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS