CORS Vulnerability in MCP Java SDK Affects Model Context Protocol Servers

CVE-2026-34237

What is CVE-2026-34237?

The MCP Java SDK, utilized for Model Context Protocol servers and clients, has a significant vulnerability due to hardcoded wildcard CORS settings. This flaw can allow unauthorized cross-origin requests, potentially leading to security breaches. Users are advised to upgrade to versions 1.0.1 or 1.1.1 to mitigate this risk and ensure secure communication between clients and servers. The patches implemented in these versions effectively address the vulnerability, reinforcing the overall security posture of applications utilizing this SDK.

References