CVE-2026-34237: MCP Java SDK CORS Vulnerability

CVE-2026-34237 Overview

CVE-2026-34237 affects the MCP Java SDK, the official Java SDK for Model Context Protocol servers and clients maintained by lfprojects. The vulnerability stems from a hardcoded wildcard Cross-Origin Resource Sharing (CORS) configuration in the HTTP transport providers. Versions prior to 1.0.1 and 1.1.1 ship with permissive CORS headers that allow any origin to interact with MCP server endpoints. This weakness is tracked as CWE-942: Permissive Cross-domain Policy with Untrusted Domains. The flaw was patched in versions 1.0.1 and 1.1.1.

Critical Impact
A hardcoded wildcard CORS policy allows malicious web pages to issue cross-origin requests to MCP Java SDK servers, exposing tool invocations and SSE streams to untrusted browser-based attackers.

Affected Products

lfprojects:mcp_java_sdk versions prior to 1.0.1
lfprojects:mcp_java_sdk version 1.1.0
MCP Java SDK HTTP transports: HttpServletSseServerTransportProvider and HttpServletStreamableServerTransportProvider

Discovery Timeline

2026-03-31 - CVE-2026-34237 published to NVD
2026-04-03 - Last updated in NVD database

Technical Details for CVE-2026-34237

Vulnerability Analysis

The MCP Java SDK exposes server functionality over HTTP using two servlet-based transport providers: HttpServletSseServerTransportProvider for Server-Sent Events (SSE) and HttpServletStreamableServerTransportProvider for streamable HTTP transport. Both classes set CORS response headers with a hardcoded wildcard origin, instructing browsers to permit cross-origin access from any domain. This eliminates the same-origin restrictions that normally protect HTTP endpoints embedded in developer or enterprise tooling.

Model Context Protocol servers frequently expose sensitive capabilities such as tool execution, file access, and downstream API connectors. When such a server is reachable from a developer workstation, an attacker-controlled web page visited in any browser session can issue requests to the local or internal MCP endpoint and read responses. User interaction is required because the victim must load the malicious page, which aligns with the network attack vector and required user interaction described in the advisory.

Root Cause

The transport providers statically assign a wildcard value to the Access-Control-Allow-Origin header in the servlet handlers referenced at line 289 of HttpServletSseServerTransportProvider.java and line 525 of HttpServletStreamableServerTransportProvider.java. The SDK provides no configuration hook for operators to restrict allowed origins, so every deployment built on these transports inherits a permissive cross-domain policy.

Attack Vector

An attacker hosts a malicious page and lures a victim with access to an MCP Java SDK server. The page executes JavaScript that issues cross-origin fetch or EventSource requests to the MCP endpoint. Because the server responds with a wildcard CORS header, the browser permits the script to read responses, enumerate tools, and trigger tool invocations within the victim's network context. The vulnerability description and references do not include public exploitation code.

Detection Methods for CVE-2026-34237

Indicators of Compromise

Unexpected cross-origin HTTP requests to MCP server endpoints originating from external Origin headers
HTTP responses from MCP Java SDK transports containing Access-Control-Allow-Origin: *
Browser-initiated EventSource or fetch traffic to internal MCP ports from non-developer web origins

Detection Strategies

Inventory Java applications that import io.modelcontextprotocol packages and verify the SDK version against 1.0.1 or 1.1.1
Inspect HTTP responses from MCP endpoints for wildcard CORS headers using automated scanners or curl -I
Review web proxy and reverse proxy logs for Origin headers that do not match approved internal origins

Monitoring Recommendations

Log and alert on cross-origin requests targeting MCP server URIs, especially OPTIONS preflight requests from unknown origins
Monitor outbound browser telemetry for connections to local MCP ports from untrusted page contexts
Track dependency manifests (pom.xml, build.gradle) in CI for vulnerable MCP Java SDK versions

How to Mitigate CVE-2026-34237

Immediate Actions Required

Upgrade lfprojects:mcp_java_sdk to version 1.0.1 or 1.1.1 depending on the release line in use
Audit all running MCP Java SDK servers and confirm they are not exposed beyond trusted network boundaries
Restart Java processes after upgrading to ensure the patched transport classes are loaded

Patch Information

The MCP Java SDK maintainers fixed the issue in versions 1.0.1 and 1.1.1. Details are published in the GitHub Security Advisory GHSA-hv2w-8mjj-jw22. The vulnerable code locations are documented in HttpServletSseServerTransportProvider.java line 289 and HttpServletStreamableServerTransportProvider.java line 525.

Workarounds

Place MCP Java SDK servers behind a reverse proxy that overrides the Access-Control-Allow-Origin header with an explicit allowlist
Bind MCP transports to localhost only and require authenticated tunnels for remote access
Use a servlet filter to strip or replace wildcard CORS headers before responses leave the application

bash

# Example nginx reverse proxy snippet enforcing a strict CORS allowlist
location /mcp/ {
    proxy_pass http://127.0.0.1:8080/;
    proxy_hide_header Access-Control-Allow-Origin;
    add_header Access-Control-Allow-Origin "https://trusted.internal.example" always;
    add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
    add_header Vary "Origin" always;
}