CVE-2026-34237: MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)
Summary
Hardcoded Wildcard CORS (Access-Control-Allow-Origin: )
- https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletSseServerTransportProvider.java#L289 - https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java#L525
Attack Scenario An attacker-controlled web page instructs the victim's browser to open GET https://internal-mcp-server/sse. Because Access-Control-Allow-Origin: allows cross-origin SSE reads, the attacker's page receives the endpoint event — which contains the session ID. The attacker can then POST to that endpoint from their page using the victim's browser as a relay.
Comparison with python-sdk No Access-Control-Allow-Origin header is emitted by either Python transport. The browser's default same-origin policy remains in full effect. https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/sse.py https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/streamablehttp.py
Recommendation In the SDK, the transport layer should not own CORS policy. Server implementors who need cross-origin access can add a CORS filter at the servlet filter or Spring Security layer.
Resources
- https://cheatsheetseries.owasp.org/cheatsheets/HTTPHeadersCheatSheet.html#access-control-allow-origin
Other sources
MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.
— MITRE
MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 1.0.1 and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 1.0.1 and 1.1.1.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.modelcontextprotocol.sdk:mcp-coreto a version that resolves this vulnerability.Fixed in 1.1.1 - Upgrade
Upgrade
maven/io.modelcontextprotocol.sdk:mcp-coreto a version that resolves this vulnerability.Fixed in 1.0.1 - Upgrade
Upgrade
modelcontextprotocol/java-sdkto a version that resolves this vulnerability.Fixed in 0.83.0 - Upgrade
Upgrade
modelcontextprotocol/java-sdkto a version that resolves this vulnerability.Fixed in 1.0.1 - Upgrade
Upgrade
modelcontextprotocol/java-sdkto a version that resolves this vulnerability.Fixed in 1.1.1 - Configuration
Do not emit a hardcoded wildcard CORS policy from the MCP Java SDK transport layer; if cross-origin access is required, implement a CORS filter at the servlet filter or Spring Security layer instead of using Access-Control-Allow-Origin: *.
MCP Java SDK transport (servlet/Spring Security) Access-Control-Allow-Origin = not "*"
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34237?
CVE-2026-34237 is classified as a high severity vulnerability due to the hardcoded wildcard CORS implementation.
How do I fix CVE-2026-34237?
To fix CVE-2026-34237, upgrade to version 1.1.1 or to version 1.0.1 of the affected package.
What does CVE-2026-34237 affect?
CVE-2026-34237 affects the io.modelcontextprotocol.sdk:mcp-core package versions 1.1.0 and lower.
What is a hardcoded wildcard CORS vulnerability like CVE-2026-34237?
A hardcoded wildcard CORS vulnerability allows any domain to access resources, posing security risks such as data exposure.
When was CVE-2026-34237 disclosed?
CVE-2026-34237 was disclosed as part of a GitHub advisory regarding security issues in the Java SDK.