CVE-2026-35568: 
Java vulnerability analysis and mitigation

CVE-2026-35568 is a DNS rebinding vulnerability in the Model Context Protocol (MCP) Java SDK (io.modelcontextprotocol.sdk:mcp-core) that allows an attacker to access a locally or network-private MCP server via a victim's browser. All versions prior to 1.0.0 are affected. The vulnerability was published on April 7, 2026, by researcher JLLeitschuh via GitHub Security Advisories. It carries a CVSS v4.0 base score of 7.6 (High) and a CVSS v3.1 base score of 5.7 (Medium) (Github Advisory, MCP Advisory).

The root cause is an Origin Validation Error (CWE-346): prior to version 1.0.0, the java-sdk performed no validation of the Origin header on incoming HTTP connections, directly violating the MCP specification's security requirement that "Servers MUST validate the Origin header on all incoming connections to prevent DNS rebinding attacks." In a DNS rebinding attack, an attacker tricks a victim's browser into treating a malicious domain as a trusted local address, then uses JavaScript to issue cross-origin requests to the locally running MCP server. Because no CORS or Origin header checks were enforced, the server would accept these requests as if they originated from a legitimate, locally connected MCP AI agent. MCP servers built on frameworks with built-in CORS enforcement (e.g., Spring AI) were not affected by this issue (Github Advisory, MCP Advisory).

Successful exploitation allows an attacker to make arbitrary tool calls to a victim's local or private-network MCP server, effectively impersonating a locally connected AI agent. This poses a high integrity risk, as the attacker can invoke any tool exposed by the MCP server — potentially modifying data, triggering automated workflows, or interacting with connected AI systems — without the victim's knowledge. The confidentiality impact is also rated high under CVSS v4.0, as tool calls may expose sensitive data accessible to the MCP server. Availability is not directly impacted (Github Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-35568. The EPSS score is approximately 0.016% (4th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a victim developer must visit a malicious website while their local MCP server is running — which limits the attack surface (Github Advisory).

1. Set up malicious domain: The attacker registers a domain (e.g., attacker.com) and configures a DNS server with a very short TTL (e.g., 1 second) that initially resolves to the attacker's public IP.
2. Host malicious page: The attacker hosts a web page on attacker.com containing JavaScript designed to perform DNS rebinding. The page loads in the victim's browser.
3. DNS rebinding: After the initial page load, the attacker's DNS server changes the resolution of attacker.com to 127.0.0.1 (or a private network IP where the MCP server is running). The browser's DNS cache expires due to the short TTL.
4. Cross-origin request to MCP server: The attacker's JavaScript now issues HTTP requests to attacker.com:<MCP_PORT>. The browser resolves this to 127.0.0.1:<MCP_PORT>, effectively targeting the victim's local MCP server. Because the java-sdk (pre-1.0.0) does not validate the Origin header, the server accepts these requests.
5. Unauthorized tool calls: The attacker's JavaScript sends crafted MCP tool-call requests to the local server, executing any tool available to the MCP agent — such as reading files, querying databases, or triggering AI workflows — and exfiltrating results back to the attacker (Github Advisory, MCP Advisory).

• Network: Unexpected HTTP requests to the local MCP server port (default varies) originating from browser processes; outbound connections from the MCP server to unfamiliar external IPs following tool invocations.
• Logs: MCP server access logs showing tool-call requests with Origin headers referencing external or unknown domains (e.g., Origin: http://attacker.com); repeated requests from 127.0.0.1 or local network addresses with mismatched Host headers.
• Process: Unusual child processes or system actions triggered by the MCP server's tool execution (e.g., file reads, database queries, or network calls) not initiated by the expected AI agent client.
• Browser: Browser history or network traffic logs showing visits to unfamiliar domains shortly before anomalous MCP server activity (Github Advisory).

The primary remediation is to upgrade io.modelcontextprotocol.sdk:mcp-core to version 1.0.0 or later, which introduces Origin header validation in compliance with the MCP specification (MCP Release). For users unable to upgrade immediately, two workarounds are available: (1) deploy the MCP server behind a reverse proxy (such as Nginx or HAProxy) configured to strictly validate Host and Origin headers; or (2) use a framework with built-in CORS and Origin validation, such as Spring AI, which is not vulnerable to this issue (Github Advisory).

The vulnerability was reported by security researcher JLLeitschuh and published via GitHub Security Advisories on April 7, 2026. The advisory was picked up by several vulnerability tracking services and security news outlets shortly after disclosure. Coverage noted the broader concern of DNS rebinding attacks against locally running AI/MCP infrastructure, with some outlets highlighting the risk to enterprise environments (Github Advisory).