The MCP Java SDK contains a DNS rebinding flaw that lets an attacker trick a victim’s browser into communicating with a locally or network‑private MCP server. By resolving the server’s internal hostname to the attacker’s domain, the browser can issue tool calls that normally require trust, effectively acting as if the attacker were a bona‑fide local agent. This grants the attacker the ability to invoke any exposed function on the MCP server, risking arbitrary code execution and data leakage. The weakness is classified as CW‑346, a misuse of resources through identity circumvention.

The vulnerability affects the Model Context Protocol Java SDK, specifically versions older than 1.0.0. System administrators using these versions should verify that the application runs on a protected network and is not accessible from untrusted browsers.

The CVSS base score of 7.6 indicates a high severity, but the EPSS score of less than 1 % shows a low probability of exploitation in the wild. The flaw is not yet listed in the CISA KEV catalog. Exploitation requires an attacker to host a malicious site and convince a victim with network proximity to visit it, making the attack vector a web‑based DNS rebinding scenario.