Junglewise Threat Intelligence

CVE-2026-34237: Model Context Protocol Java SDK hardcoded wildcard CORS policy

CVE-2026-34237 · Severity: medium · CVSS 6.1 · Published 2026-03-31

Vendors: Model Context Protocol.

Executive brief

The official Java SDK for the Model Context Protocol (MCP) contains a security flaw that allows unauthorized websites to interact with MCP servers. By default, the software permits any website to read sensitive session information if a user visits a malicious page while connected to an internal MCP server. This could allow an attacker to hijack sessions and perform actions on the server using the victim's browser as a relay.

Technical details

A hardcoded wildcard CORS policy (Access-Control-Allow-Origin: *) exists in the HttpServletSseServerTransportProvider and HttpServletStreamableServerTransportProvider components of the MCP Java SDK. This vulnerability (CWE-942) allows an attacker-controlled web page to bypass the Same-Origin Policy (SOP) and read Server-Sent Events (SSE) streams, which contain session identifiers. With these identifiers, an attacker can perform cross-origin POST requests to the server's endpoints using the victim's browser. The issue is resolved in versions 0.83.0, 1.0.1, and 1.1.1 by removing the hardcoded header and deferring CORS policy management to the server implementer.

Affected products

  • Model Context Protocol MCP Java SDK (mcp-core) < 0.83.0, < 1.0.1, < 1.1.1

Timeline

  • 2026-03-30: advisory: GitHub Security Advisory GHSA-hv2w-8mjj-jw22 published
  • 2026-03-31: disclosed: CVE-2026-34237 published to NVD

References