CVE-2026-34237CWE-942

MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)

Medium · published March 31, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
22.6
In the wild
Unconfirmed
What it is

MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00310 · 22.6th percentile
Weakness
CWE-942 · Permissive Cross-domain Security Policy with Untrusted Domains
Published
2026-03-31T15:40Z
EPSS history
Timeline
  • 31 MAR 15:40Z
    MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)
    cvelistv5