# CVE-2026-35568: Model Context Protocol Java SDK DNS rebinding in mcp-core

Source: https://junglewise.ai/threats/cve-2026-35568-model-context-protocol-java-sdk-dns-rebinding-in-mcp-core  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-35568 · Severity: medium · CVSS 5.7 · Published 2026-04-07

The official Java SDK for the Model Context Protocol (MCP), used to build AI agent servers and clients, contains a security flaw that could allow unauthorized access. By tricking a user into visiting a malicious website, an attacker can bypass security boundaries to send commands to a private AI server running on the user's local machine or internal network. This could allow the attacker to execute tools and actions as if they were a legitimate local AI agent, potentially leading to data exposure or unauthorized operations.

Vendors: [Lfprojects](https://junglewise.ai/threats/vendors/lfprojects), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-35568 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35568 being exploited in the wild.

**How severe is CVE-2026-35568?** Medium severity, with a CVSS score of 5.7, published 7 April 2026.

**Which products and versions are affected?** io.modelcontextprotocol.sdk:mcp-core (Maven) ECOSYSTEM:introduced=0,fixed=1.0.0.

**Is there a fix for CVE-2026-35568?** Yes. io.modelcontextprotocol.sdk:mcp-core (Maven): upgrade to 1.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35568 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-35568?** Check whether you run Lfprojects Mcp Java Sdk or io.modelcontextprotocol.sdk:mcp-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.modelcontextprotocol.sdk:mcp-core (Maven): upgrade to 1.0.0 or later

  ```sh
  # set io.modelcontextprotocol.sdk:mcp-core to 1.0.0 in your pom.xml or build.gradle
  ```


## Technical details

The MCP Java SDK (specifically the mcp-core package) failed to implement Origin header validation as required by the Model Context Protocol specification. This omission enables DNS rebinding attacks where a malicious website, visited by a victim, can bridge the gap between the public internet and the victim's local or private network. An attacker can then interact with the MCP server's API, performing tool calls with the same privileges as a locally connected AI agent. The vulnerability is present in versions prior to 1.0.0; however, implementations using Spring AI are noted as not vulnerable due to inherent framework protections. The issue is resolved in version 1.0.0 by adding proper authorization conformance and Origin validation.

## Affected products

- Model Context Protocol (MCP) java-sdk (mcp-core) < 1.0.0

## Identifiers

- CVE-2026-35568
- GHSA-8jxr-pr72-r468

## Timeline

- 2026-04-07: disclosed
- 2026-04-07: advisory
- 2026-02-23: patched: Version 1.0.0 released

## References

- [https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.0.0](https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.0.0)
- [https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-8jxr-pr72-r468](https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-8jxr-pr72-r468)

## Related threats

- [Model Context Protocol Java SDK hardcoded wildcard CORS policy](https://junglewise.ai/threats/cve-2026-34237-model-context-protocol-java-sdk-hardcoded-wildcard-cors-policy)