What is the CVSS score of CVE-2026-34237?

CVE-2026-34237 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34237?

Yes, a patch is available for CVE-2026-34237. Update the affected software to the latest version immediately.

Python CVE-2026-34237

MEDIUM

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-03-30 https://github.com/modelcontextprotocol/java-sdk

GHSA-hv2w-8mjj-jw22

Python Java Information Disclosure Cors Misconfiguration

6.1

CVSS 3.1 · Vendor: https://github.com/modelcontextprotocol/java-sdk

Severity by source

Vendor (https://github.com/modelcontextprotocol/java-sdk) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (https://github.com/modelcontextprotocol/java-sdk) · only source for this CVE.

CVSS VectorVendor: https://github.com/modelcontextprotocol/java-sdk

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 30, 2026 - 17:36 vuln.today

CVE Published

Mar 30, 2026 - 17:26 nvd

MEDIUM 6.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

38 maven packages depend on io.modelcontextprotocol.sdk:mcp-core (13 direct, 25 indirect)

Ecosystem-wide dependent count for version 1.0.0.

DescriptionCVE.org

Summary

Hardcoded Wildcard CORS (Access-Control-Allow-Origin: * )

https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletSseServerTransportProvider.java#L289
https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java#L525

Attack Scenario

An attacker-controlled web page instructs the victim's browser to open GET https://internal-mcp-server/sse. Because Access-Control-Allow-Origin: * allows cross-origin SSE reads, the attacker's page receives the endpoint event - which contains the session ID. The attacker can then POST to that endpoint from their page using the victim's browser as a relay.

Comparison with python-sdk

No Access-Control-Allow-Origin header is emitted by either Python transport. The browser's default same-origin policy remains in full effect. https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/sse.py https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/streamable_http.py

Recommendation

In the SDK, the transport layer should not own CORS policy. Server implementors who need cross-origin access can add a CORS filter at the servlet filter or Spring Security layer.

Resources

https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#access-control-allow-origin

AnalysisAI

Hardcoded wildcard CORS headers (Access-Control-Allow-Origin: *) in the Model Context Protocol Java SDK transport layer enable cross-origin session hijacking, allowing attackers to extract session IDs from victim browsers and relay authenticated requests back to internal MCP servers. The vulnerability affects the HttpServletSseServerTransportProvider and HttpServletStreamableServerTransportProvider classes in mcp-core; no public exploit code has been identified, though the attack requires user interaction (victim visiting attacker-controlled page). CVSS 6.1 reflects the combination of network-accessible vector, low attack complexity, and cross-origin impact, though practical exploitation depends on MCP server deployment architecture.

Technical ContextAI

The Model Context Protocol Java SDK implements two HTTP-based server transports for streaming operations: Server-Sent Events (SSE) and a streamable HTTP transport. Both transport providers unconditionally emit Access-Control-Allow-Origin: * response headers, which tells victim browsers that cross-origin JavaScript from any domain may read the response body and headers. Server-Sent Events (SSE) is a unidirectional streaming protocol where the server pushes data to connected clients; the MCP protocol uses SSE endpoints to transmit session initialization data including session IDs. Affected products are identified by Maven coordinates io.modelcontextprotocol.sdk:mcp-core. The root cause is classified as CWE-942 (Permissive Cross-domain Policy), a category that captures overly permissive CORS configurations that violate the browser's same-origin security policy. The Python SDK does not exhibit this flaw because its SSE and HTTP transport implementations do not emit CORS headers at all, relying on browser default same-origin enforcement.

RemediationAI

Patch the Java SDK by removing hardcoded Access-Control-Allow-Origin: * headers from the HttpServletSseServerTransportProvider and HttpServletStreamableServerTransportProvider classes. Implementors should delegate CORS policy to the servlet container or framework layer (e.g., Spring Security, servlet filters) rather than the transport SDK. If a patched version of mcp-core is released, upgrade to that version immediately. As a temporary workaround, server implementors can add a servlet filter or Spring Security configuration that strips or overrides the CORS headers emitted by the transport layer, enforcing the restrictive same-origin policy by default. For deployments requiring genuine cross-origin access, explicitly configure a CORS filter with a allowlist of trusted origins rather than wildcard patterns. Consult the OWASP HTTP Headers Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#access-control-allow-origin) for correct CORS implementation guidance.