{"id":"CVE-2026-34237","aliases":["EUVD-2026-17496","GHSA-hv2w-8mjj-jw22"],"status":"published","title":"MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)","description":"MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00231,"percentile":0.14048,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-942"],"published":"2026-03-30T17:26:44Z","modified":"2026-10-28T02:30:28Z","fixes":[{"ecosystem":"Maven","package":"io.modelcontextprotocol.sdk:mcp-core","fixed_in":["1.1.1","1.0.1","0.18.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.modelcontextprotocol.sdk:mcp-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"last_affected":"1.1.0"},{"fixed":"1.1.1"}]}],"versions":["1.1.0"]},{"source":"ghsa","ecosystem":"Maven","package":"io.modelcontextprotocol.sdk:mcp-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"last_affected":"1.0.0"},{"fixed":"1.0.1"}]}],"versions":["1.0.0"]},{"source":"ghsa","ecosystem":"Maven","package":"io.modelcontextprotocol.sdk:mcp-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.modelcontextprotocol.sdk:mcp-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}],"versions":["1.0.0"]},{"source":"osv","ecosystem":"Maven","package":"io.modelcontextprotocol.sdk:mcp-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.1"}]}],"versions":["1.1.0"]},{"source":"osv","ecosystem":"Maven","package":"io.modelcontextprotocol.sdk:mcp-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.3"}]}],"versions":["0.13.0","0.13.1","0.14.0","0.14.1","0.15.0","0.16.0","0.17.0","0.17.1","0.17.2","0.18.0","0.18.1","0.18.2"]}],"products":[{"vendor":"lfprojects","product":"mcp_java_sdk"},{"vendor":"modelcontextprotocol","product":"java-sdk"}],"references":[{"url":"https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-hv2w-8mjj-jw22","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletSseServerTransportProvider.java#L289","tags":["x_refsource_MISC","Patch","web"]},{"url":"https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java#L525","tags":["x_refsource_MISC","Patch","web"]},{"url":"https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#access-control-allow-origin","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34237","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hv2w-8mjj-jw22"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34237.json","tags":["advisory"]},{"url":"https://github.com/modelcontextprotocol/java-sdk","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-34237","title":"MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)","description":"MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.","status":"published","published":"2026-03-31T15:40:01.07Z","modified":"2026-06-09T18:39:37.473Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-942"],"updated_at":"2026-11-02T14:20:13.962274Z"}],"euvd":[{"id":"EUVD-2026-17496","description":"MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.","status":"published","published":"2026-03-31T15:40:01Z","modified":"2026-06-09T18:39:37Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:45.803611Z"}],"ghsa":[{"id":"GHSA-hv2w-8mjj-jw22","title":"MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)","description":"### Summary\n\n**Hardcoded Wildcard CORS (Access-Control-Allow-Origin: * )**\n\n- https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletSseServerTransportProvider.java#L289\n- https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java#L525\n\n### Attack Scenario\nAn attacker-controlled web page instructs the victim's browser to open GET https://internal-mcp-server/sse. Because Access-Control-Allow-Origin: * allows cross-origin SSE reads, the attacker's page receives the endpoint event — which contains the session ID. The attacker can then POST to that endpoint from their page using the victim's browser as a relay.\n\n### Comparison with python-sdk\nNo Access-Control-Allow-Origin header is emitted by either Python transport. The browser's default same-origin policy remains in full effect.\nhttps://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/sse.py\nhttps://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/streamable_http.py\n\n### Recommendation\nIn the SDK, the transport layer should not own CORS policy. Server implementors who need cross-origin access can add a CORS filter at the servlet filter or Spring Security layer.\n\n### Reference\n\n- https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#access-control-allow-origin","status":"published","published":"2026-03-30T17:26:44Z","modified":"2026-06-09T18:39:05Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-942"],"updated_at":"2026-11-02T14:40:24.856614Z"}],"nvd":[{"id":"CVE-2026-34237","description":"MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.","status":"published","published":"2026-03-31T16:16:32.923Z","modified":"2026-07-24T20:10:00.147Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-942"],"updated_at":"2026-11-02T14:12:12.261218Z"}],"osv":[{"id":"CVE-2026-34237","title":"MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)","description":"MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.","status":"published","published":"2026-03-31T15:40:01.07Z","modified":"2026-10-28T02:30:28.361236126Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-942"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"GHSA-hv2w-8mjj-jw22","title":"MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)","description":"### Summary\n\n**Hardcoded Wildcard CORS (Access-Control-Allow-Origin: * )**\n\n- https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletSseServerTransportProvider.java#L289\n- https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java#L525\n\n### Attack Scenario\nAn attacker-controlled web page instructs the victim's browser to open GET https://internal-mcp-server/sse. Because Access-Control-Allow-Origin: * allows cross-origin SSE reads, the attacker's page receives the endpoint event — which contains the session ID. The attacker can then POST to that endpoint from their page using the victim's browser as a relay.\n\n### Comparison with python-sdk\nNo Access-Control-Allow-Origin header is emitted by either Python transport. The browser's default same-origin policy remains in full effect.\nhttps://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/sse.py\nhttps://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/streamable_http.py\n\n### Recommendation\nIn the SDK, the transport layer should not own CORS policy. Server implementors who need cross-origin access can add a CORS filter at the servlet filter or Spring Security layer.\n\n### Reference\n\n- https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#access-control-allow-origin","status":"published","published":"2026-03-30T17:26:44Z","modified":"2026-09-10T03:50:39.742363136Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-942"],"updated_at":"2026-11-02T15:46:49.621585Z"}]}}