TI-2026-27672 Aliases CVE-2026-35568 GHSA-8jxr-pr72-r468

MCP Java-SDK has a DNS Rebinding Vulnerability

LOW 34CWE-346Published 2026-04-07 · Updated 2026-04-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346.

Summary

MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to 1.0.0, the java-sdk contains a DNS rebinding vulnerability. This vulnerability allows an attacker to access a locally or network-private java-sdk MCP server via a victims browser that is either local, or network adjacent. This allows an attacker to make any tool call to the server as if they were a locally running MCP connected AI agent. This vulnerability is fixed in 1.0.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00143 3rd percentileScored 2026-11-07

Fix Fixed java-sdk (modelcontextprotocol): 1.0.0io.modelcontextprotocol.sdk:mcp-core (Maven): 1.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MLflow	java-sdk	before 1.0.0	1.0.0	Patch available	CNA
—	io.modelcontextprotocol.sdk:mcp-core (Maven)	before 1.0.0	1.0.0	Patch available	GHSA-8jxr-pr72-r468

java-sdk VendorMLflow Affected before 1.0.0 Fixed in 1.0.0 Patch available CNA
io.modelcontextprotocol.sdk:mcp-core (Maven) Vendor— Affected before 1.0.0 Fixed in 1.0.0 Patch available GHSA-8jxr-pr72-r468

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:lfprojects:mcp_java_sdk::::::::	before 1.0.0	Vulnerable	MLflow

cpe:2.3:a:lfprojects:mcp_java_sdk:*:*:*:*:*:*:*:* Versions before 1.0.0 Vulnerable ·MLflow

Remediation

Fix · CNA java-sdk (modelcontextprotocol) Fixed in 1.0.0
Fix · GHSA-8jxr-pr72-r468 io.modelcontextprotocol.sdk:mcp-core (Maven) Fixed in 1.0.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-35568
2026-10-03 Alias added: GHSA-8jxr-pr72-r468

References

Advisory 2

Other 2

TI-2026-26532 MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *) CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences