io.modelcontextprotocol.sdk/mcp-core vulnerabilities

Latest io.modelcontextprotocol.sdk/mcp-core CVEs

Newest publication first

1. CVE-2026-35568 MCP Java-SDK has a DNS Rebinding Vulnerability

   Published 2026-04-07

   High·CVSS 7.6 EPSS 0.16%

   MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to 1.0.0, the java-sdk contains a DNS rebinding vulnerability. This vulnerability allows an attacker to access a locally or network-private java-sdk MCP server via a victims browser that i...

2. CVE-2026-34237 MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)

   Published 2026-03-31

   Medium·CVSS 6.1 EPSS 0.23%

   MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.