Description
MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 1.0.1 and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 1.0.1 and 1.1.1.
Published: 2026-03-31
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unrestricted cross‑origin resource sharing can lead to unintended data exposure from one domain to another.
Action: Update SDK
AI Analysis

Impact

The MCP Java SDK hardcodes the HTTP header Access‑Control‑Allow‑Origin to an asterisk, permitting any web origin to issue cross‑origin requests and read responses. This CORS misconfiguration enables potential data leakage or cross‑site request forgery if the application exposes sensitive endpoints behind the SDK.

Affected Systems

The vulnerability affects the Model Context Protocol Java SDK for all releases prior to version 1.0.1 and 1.1.1. Clients and servers that integrate the SDK before these patch releases are susceptible; the patched versions introduce a non‑wildcard or configurable CORS policy.

Risk and Exploitability

With a CVSS score of 6.1 and an EPSS below 1 %, the risk is moderate and exploitation is unlikely but plausible. Attackers can exploit the flaw remotely by hosting a malicious web page, sending requests to the SDK’s endpoints, and reading the responses due to the permissive CORS header. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation currently.

Generated by OpenCVE AI on April 3, 2026 at 17:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the MCP Java SDK to version 1.0.1 or later (including 1.1.1) where the wildcard CORS header has been removed.

Generated by OpenCVE AI on April 3, 2026 at 17:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-hv2w-8mjj-jw22 MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)
History

Fri, 03 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Lfprojects
Lfprojects mcp Java Sdk
CPEs cpe:2.3:a:lfprojects:mcp_java_sdk:*:*:*:*:*:*:*:*
cpe:2.3:a:lfprojects:mcp_java_sdk:1.1.0:*:*:*:*:*:*:*
Vendors & Products Lfprojects
Lfprojects mcp Java Sdk

Fri, 03 Apr 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Modelcontextprotocol
Modelcontextprotocol java-sdk
Vendors & Products Modelcontextprotocol
Modelcontextprotocol java-sdk

Tue, 31 Mar 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 31 Mar 2026 16:00:00 +0000

Type Values Removed Values Added
Description MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 1.0.1 and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 1.0.1 and 1.1.1.
Title MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)
Weaknesses CWE-942
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Lfprojects Mcp Java Sdk
Modelcontextprotocol Java-sdk
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-03-31T18:52:38.217Z

Reserved: 2026-03-26T16:22:29.034Z

Link: CVE-2026-34237

cve-icon Vulnrichment

Updated: 2026-03-31T18:50:16.963Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-31T16:16:32.923

Modified: 2026-04-03T14:29:40.640

Link: CVE-2026-34237

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-03T21:17:34Z

Weaknesses