CVE-2026-34237

MediumCVSS 6.1/10Last modified Jul 24, 2026

Description

MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-942

Affected software

Vendor	Product	Versions
modelcontextprotocol	java-sdk	>= 1.0.0, < 1.0.1; >= 1.1.0, < 1.1.1; < 0.18.3

References

Timeline

Published: Mar 31, 2026
Last modified: Jul 24, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-342385.5ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44 CVE-2026-342397.5Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endp CVE-2026-34245.3The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all vers CVE-2026-342407.5JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose could allow an unauthen CVE-2026-342418.7CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulner CVE-2026-342427.7Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially f CVE-2026-342439.8wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitH CVE-2026-342445.0Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Ad CVE-2026-342456.3WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/PlayLists/View/Playlists_schedules/add.json.CVE-2026-342464.8CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulner CVE-2026-342475.4WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Live/uploadPoster.php` endpoint allows any a CVE-2026-342485.7Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, customers in shared organizations (means they can see ea