Which versions of Java are affected by EUVD-2026-19954?

CVE-2026-35568 affects the Model Context Protocol (MCP) Java SDK versions before v1.0.0, allowing remote attackers to bypass origin validation and invoke arbitrary tool calls on local or…. A patch is available.

How to fix or mitigate EUVD-2026-19954?

Within 24 hours: Inventory all applications and services using MCP Java SDK and identify current versions deployed. Within 7 days: Upgrade MCP Java SDK to version v1.0.0 or later across all affected systems. Within 30 days: Conduct security review of MCP server deployments to ensure Origin header validation is properly enforced; implement additional network segmentation to restrict access to MCP servers from untrusted networks.

Java EUVD-2026-19954

Q: What is the CVSS score of EUVD-2026-19954?

EUVD-2026-19954 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-35568 HIGH

Origin Validation Error (CWE-346)

2026-04-07 https://github.com/modelcontextprotocol/java-sdk

GHSA-8jxr-pr72-r468

Nginx Information Disclosure Java

7.6

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch released

Apr 08, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 07, 2026 - 20:16 euvd

EUVD-2026-19954

Analysis Generated

Apr 07, 2026 - 20:16 vuln.today

CVE Published

Apr 07, 2026 - 20:13 nvd

HIGH 7.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

33 maven packages depend on io.modelcontextprotocol.sdk:mcp-core (12 direct, 21 indirect)

Ecosystem-wide dependent count for version 1.0.0.

DescriptionGitHub Advisory

Summary

The java-sdk contains a DNS rebinding vulnerability. This vulnerability allows an attacker to access a locally or network-private java-sdk MCP server via a victims browser that is either local, or network adjacent.

This allows an attacker to make any tool call to the server as if they were a locally running MCP connected AI agent.

Details

Prior to 1.0.0 no Origin header validation was occurring, in violation of the MCP specification. Base Protocol > Transports: 2.0.1 Security Warning:

> 1: Servers MUST validate the Origin header on all incoming connections to prevent DNS rebinding attacks.

When the web server serving HTTP traffic to the MCP server does not perform standard CORS checks, a DNS rebinding attack is possible.

Some default server configurations and frameworks come with embedded Origin header validation. MCP servers built using those are not vulnerable to this issue. For example, the following are NOT vulnerable:

Spring AI

Impact

Any developer connecting to a malicious website can inadvertently allow an attacker to make tool calls to local or private-network MCP servers.

Workarounds

Users can mitigate this risk by:

Running the MCP server behind a reverse proxy (like Nginx or HAProxy) configured to strictly validate the Host and Origin headers.
Using a framework that inherently enforces strict CORS and Origin validation (such as Spring AI).

AnalysisAI

DNS rebinding in Model Context Protocol (MCP) Java SDK before v1.0.0 enables remote attackers to invoke arbitrary tool calls on local or network-private MCP servers via a victim's browser. The SDK failed to validate Origin headers per MCP specification requirements, violating mandatory server-side protections against cross-origin attacks. Exploitation requires social engineering (victim visits malicious site), but grants full tool invocation privileges as if the attacker were a locally authorized AI agent. Patch available in v1.0.0. No public exploit identified at time of analysis, but attack technique is well-understood (DNS rebinding). EPSS data not available; authentication requirements not confirmed from available data.

Technical ContextAI

The Model Context Protocol (MCP) is a framework for AI agents to interact with external tools and services via standardized server interfaces. The java-sdk (pkg:maven/io.modelcontextprotocol.sdk:mcp-core) provides server-side Java implementation for MCP tool hosting. Versions prior to 1.0.0 failed to implement mandatory Origin header validation specified in MCP 2025-06-18 Base Protocol Transport Security requirements. This omission creates a classic DNS rebinding vulnerability (CWE-346: Origin Validation Error), where an attacker controls a domain with rapidly-changing DNS records to bypass Same-Origin Policy protections. The attacker's page loads in victim's browser, DNS resolves to localhost/private IP, browser sends requests appearing to originate from trusted origin. Without server-side Origin validation, the MCP server accepts cross-origin requests from attacker-controlled pages targeting private network endpoints. Framework-specific mitigations exist: Spring AI provides built-in CORS/Origin enforcement, making Spring-based MCP servers immune even when using vulnerable SDK versions.

RemediationAI

Upgrade to Model Context Protocol Java SDK version 1.0.0 or later, which implements mandatory Origin header validation per MCP specification requirements. The patched release is available at github.com/modelcontextprotocol/java-sdk/releases/tag/v1.0.0 and via Maven Central. For environments unable to immediately upgrade, deploy MCP servers behind reverse proxy infrastructure configured to enforce strict Host and Origin header validation (Nginx, HAProxy, or equivalent). Alternatively, migrate to MCP server implementations using frameworks with built-in CORS protections such as Spring AI, which inherently validates Origin headers regardless of SDK version. Review network exposure of MCP servers and restrict access to trusted networks only. Developers should avoid accessing untrusted websites while running local MCP servers on development machines. Full advisory and remediation guidance available at github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-8jxr-pr72-r468.