CVE-2026-34237: 
Java vulnerability analysis and mitigation

CVE-2026-34237 is a hardcoded wildcard CORS vulnerability in the MCP Java SDK (Model Context Protocol official Java SDK for servers and clients), classified as Moderate severity with a CVSS v3.1 base score of 6.1. The flaw exists in the io.modelcontextprotocol.sdk:mcp-core Maven package and affects versions prior to 0.18.3 (formerly labeled 0.83.0), 1.0.1, and 1.1.1 — specifically versions equal to 1.0.0, 1.1.0, and all versions below 0.18.3. It was published and disclosed on March 30, 2026, via a GitHub Security Advisory (GHSA-hv2w-8mjj-jw22), with NVD publication on March 31, 2026 (GitHub Advisory, MCP SDK Advisory). IBM Process Mining was also identified as an affected downstream product (IBM Advisory).

The root cause is CWE-942 (Permissive Cross-domain Policy with Untrusted Domains): the SDK's HTTP transport providers hardcode the Access-Control-Allow-Origin: * response header, bypassing the browser's default same-origin policy for all origins. The vulnerability is present in two specific transport classes: HttpServletSseServerTransportProvider.java (line 289) and HttpServletStreamableServerTransportProvider.java (line 525), both within the mcp-core module (GitHub Advisory). Because the wildcard CORS header is set unconditionally at the transport layer rather than being configurable by the server implementor, any cross-origin request from a browser is permitted to read SSE responses — including the session ID transmitted in the initial endpoint event. By contrast, the Python SDK emits no Access-Control-Allow-Origin header, leaving the browser's same-origin policy intact (MCP SDK Advisory).

An attacker who tricks a victim into visiting a malicious web page can instruct the victim's browser to open a cross-origin SSE connection to an internal MCP server (e.g., GET https://internal-mcp-server/sse). Because the wildcard CORS policy allows the attacker's page to read the SSE stream, it can extract the session ID from the endpoint event and subsequently relay authenticated POST requests through the victim's browser without the victim's knowledge or consent (GitHub Advisory). This results in low confidentiality impact (session ID theft, potential data exposure from backend MCP services) and low integrity impact (unauthorized actions relayed through the victim's session), with no direct availability impact (MCP SDK Advisory).

1. Reconnaissance: Identify targets running an internal MCP Java SDK server (versions < 0.18.3, = 1.0.0, or = 1.1.0) accessible from a victim's browser, such as developer workstations or internal tooling environments.
2. Craft malicious page: Create an attacker-controlled web page with JavaScript that initiates a cross-origin SSE connection: const evtSource = new EventSource('https://internal-mcp-server/sse');
3. Capture session ID: Because the server responds with Access-Control-Allow-Origin: *, the browser allows the attacker's page to read the SSE stream. Listen for the endpoint event, which contains the session ID: evtSource.addEventListener('endpoint', (e) => { const sessionId = extractSessionId(e.data); ... });
4. Relay authenticated requests: Using the captured session ID, instruct the victim's browser to POST messages to the MCP server's message endpoint on behalf of the victim: fetch('https://internal-mcp-server/message?sessionId=' + sessionId, { method: 'POST', body: JSON.stringify(maliciousPayload) });
5. Achieve objective: The MCP server processes the relayed request as if it originated from the legitimate victim session, enabling unauthorized data access or manipulation of backend MCP services (GitHub Advisory, MCP SDK Advisory).

• Network: Unexpected cross-origin SSE connections to the MCP server's /sse endpoint from browser-based clients originating from untrusted or external domains; POST requests to the message endpoint with session IDs that were established via cross-origin SSE connections.
• Logs: MCP server access logs showing GET /sse requests with Origin headers from unexpected or external domains immediately followed by POST /message?sessionId=<id> requests from the same session; unusual Referer headers on POST requests pointing to external sites.
• Application Behavior: Session IDs appearing in requests from IP addresses or user agents inconsistent with the original SSE connection source, suggesting browser-relayed request injection (GitHub Advisory).

Upgrade the io.modelcontextprotocol.sdk:mcp-core Maven dependency to patched versions 0.18.3, 1.0.1, or 1.1.1, which remove the hardcoded Access-Control-Allow-Origin: * header from the transport layer (GitHub Advisory). As a workaround prior to patching, server implementors requiring cross-origin access should implement CORS policies at the servlet filter or Spring Security layer rather than relying on the SDK transport, allowing fine-grained control over trusted origins. IBM Process Mining users should apply the IBM Process Mining Interim Fix for April 2026 (IBM Advisory). If cross-origin access is not required, ensure network-level controls restrict browser access to internal MCP servers from untrusted origins.

The vulnerability was reported by security researcher srikanthramu and published by Kehrlann to the modelcontextprotocol/java-sdk repository on March 30, 2026 (MCP SDK Advisory). Red Hat acknowledged the CVE on April 1, 2026. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified.