What is CVE-2026-34237?

CVE-2026-34237 is a medium-severity vulnerability in Lfprojects Mcp Java Sdk, classified under Permissive Cross-domain Policy with Untrusted Domains. CVSS score: 6.1/10. Published 2026-03-31.

How severe is CVE-2026-34237?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Vulnerability in Lfprojects Mcp Java Sdk

CVE-2026-34237

MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.

Published 2026-03-31 · last modified 2026-07-24.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

EPSS exploit prediction

EPSS: 0.003 (21.4th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 21st percentile — 21.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001

Affected products

Lfprojects Mcp Java Sdk — versions 1.1.0
Modelcontextprotocol Java-Sdk — versions < 1.1.1, >= 1.1.0, < 1.1.1, < 0.18.3

Weakness classification (CWE)

CWE-942 — Permissive Cross-domain Policy with Untrusted Domains

References

github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-hv2w-8mjj-jw22 (Mitigation, Vendor Advisory)
github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/mo… (Patch)
github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/mo… (Patch)

Frequently asked questions

What is CVE-2026-34237?: CVE-2026-34237 is a medium-severity vulnerability in Lfprojects Mcp Java Sdk, classified under Permissive Cross-domain Policy with Untrusted Domains. CVSS score: 6.1/10. Published 2026-03-31.
How severe is CVE-2026-34237?: Medium severity. CVSS v3 base score is 6.1 out of 10.