6.1Orta
CVE-2026-34237MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)
Açıklama
MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.
Zayıflık türü (CWE):
CWE-942
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| lfprojects | mcp java sdk | < 1.0.1 | |
| modelcontextprotocol | java-sdk | >= 1.0.0, < 1.0.1, >= 1.1.0, < 1.1.1, < 0.18.3 |
Kaynaklar ve yamalar
- https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-hv2w-8mjj-jw22 MitigationVendor Advisory
- https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/ser… Patch
- https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/ser… Patch
CPE eşleşmeleri (NVD) (2)
cpe:2.3:a:lfprojects:mcp_java_sdk:*:*:*:*:*:*:*:*< 1.0.1cpe:2.3:a:lfprojects:mcp_java_sdk:1.1.0:*:*:*:*:*:*:*