Skip to content
Sign in
6.1 Medium

CVE-2026-34237 MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients

Description

MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.

Affected products and versions

Product Affected versions Fixed in
java-sdk 1.1 1.1.0 → < 1.1.1 1.1.1
java-sdk 1.0 1.0.0 → < 1.0.1 1.0.1
java-sdk 0.18 earliest → < 0.18.3 0.18.3

Other CVEs of java-sdk

The 2 CVEs of java-sdk →
CVE-2026-35568 MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients 7.6 High
Track this CVE