CVE-2026-34237
Medium
Low
Medium
High
Critical
6.1
CVSS Score
Vulnerability Description
MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 1.0.1 and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 1.0.1 and 1.1.1.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
N
Attack Complexity
L
Privileges Required
N
User Interaction
R
Scope
C
Confidentiality
L
Integrity
L
Availability
N
Known Affected Software
1 configuration(s) from 1 vendor(s)
mcp_java_sdk
Version:
1.1.0
CPE:
cpe:2.3:a:lfprojects:mcp_java_sdk:1.1.0:*:*:*:*:*:*:*
This vulnerability affects 1 software configuration(s). Ensure you patch all affected systems.
Oracle
CPUAPR2026
Oracle Critical Patch Update Advisory - April 2026
Severity
Critical
Released
Apr 21, 2026
Restart Required
Security Update
References & Resources
-
https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletSseServerTransportProvider.java#L289security-advisories@github.com Patch
-
https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java#L525security-advisories@github.com Patch
-
https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-hv2w-8mjj-jw22security-advisories@github.com Mitigation Vendor Advisory
Severity Details
6.1
out of 10.0
Medium
Weakness Type (CWE)
CWE-942
Permissive Cross-domain Security Policy with Untrusted Domains
- Description
- The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
- Typical Severity
- Medium
- Abstraction Level
- Variant
Key Information
- Published Date
- March 31, 2026
