The MCP Java SDK contains a hardcoded wildcard CORS configuration that sets the Access‑Control‑Allow‑Origin header to an asterisk. This allows any external web page to issue cross‑origin requests to the SDK’s endpoints and receive responses that would normally be restricted by the same‑origin policy, effectively bypassing browser controls. The effect is that a malicious domain can read sensitive data or invoke actions exposed by the SDK, representing an access‑control weakness defined by CWE‑942.

Model Context Protocol Java SDK versions released before 1.0.1 and 1.1.1 are affected. All deployments using these iterations must review their SDK version to ensure they are not vulnerable.

The baseline severity is scored at 6.1, indicating a moderate impact. No exploit probability metric is available, and the vulnerability is not listed in the CISA KEV catalog. The attack surface is any client that can reach the SDK’s HTTP endpoints, so an attacker could craft a malicious web page that performs cross‑origin requests to retrieve data or trigger actions. While no zero‑day proofs of concept are cited, the permissive CORS exposes data to any origin, warranting prompt remediation.