Executive brief
The official Java SDK for the Model Context Protocol (MCP), used to build AI agent servers and clients, contains a security flaw that could allow unauthorized access. By tricking a user into visiting a malicious website, an attacker can bypass security boundaries to send commands to a private AI server running on the user's local machine or internal network. This could allow the attacker to execute tools and actions as if they were a legitimate local AI agent, potentially leading to data exposure or unauthorized operations.
Technical details
The MCP Java SDK (specifically the mcp-core package) failed to implement Origin header validation as required by the Model Context Protocol specification. This omission enables DNS rebinding attacks where a malicious website, visited by a victim, can bridge the gap between the public internet and the victim's local or private network. An attacker can then interact with the MCP server's API, performing tool calls with the same privileges as a locally connected AI agent. The vulnerability is present in versions prior to 1.0.0; however, implementations using Spring AI are noted as not vulnerable due to inherent framework protections. The issue is resolved in version 1.0.0 by adding proper authorization conformance and Origin validation.
Affected products
- Model Context Protocol (MCP) java-sdk (mcp-core) < 1.0.0
Timeline
- 2026-04-07: disclosed
- 2026-04-07: advisory
- 2026-02-23: patched: Version 1.0.0 released