https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 16:59:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326253 EUVD-2026-326253 https://cve.radiocsirt.org/vuln/euvd-2026-326253 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34237 <p>MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.</p> <p>MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34237 https://cve.radiocsirt.org/vuln/ghsa-hv2w-8mjj-jw22 <p><strong>Affected:</strong> Maven: io.modelcontextprotocol.sdk:mcp-core</p> <p>### Summary</p> <p>**Hardcoded Wildcard CORS (Access-Control-Allow-Origin: * )**</p> <p>- https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletSseServerTransportProvider.java#L289 - https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java#L525</p> <p>### Attack Scenario An attacker-controlled web page instructs the victim&#39;s browser to open GET https://internal-mcp-server/sse. Because Access-Control-Allow-Origin: * allows cross-origin SSE reads, the attacker&#39;s page receives the endpoint event — which contains the session ID. The attacker can then POST to that endpoint from their page using the victim&#39;s browser as a relay.</p> <p>### Comparison with python-sdk No Access-Control-Allow-Origin header is emitted by either Python transport. The browser&#39;s default same-origin policy remains in full effect. https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/sse.py https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/streamable_http.py</p> <p>### Recommendation In the SDK, the transport layer should not own CORS policy. Server implementors who need cross-origin access can add a CORS filter at the servlet filter or Spring Security layer.</p> <p>### Reference</p> <p>- https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#access-control-allow-origin</p> <p><strong>Affected:</strong> Maven: io.modelcontextprotocol.sdk:mcp-core</p> <p>### Summary</p> <p>**Hardcoded Wildcard CORS (Access-Control-Allow-Origin: * )**</p> <p>- https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletSseServerTransportProvider.java#L289 - https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java#L525</p> <p>### Attack Scenario An attacker-controlled web page instructs the victim&#39;s browser to open GET https://internal-mcp-server/sse. Because Access-Control-Allow-Origin: * allows cross-origin SSE reads, the attacker&#39;s page receives the endpoint event — which contains the session ID. The attacker can then POST to that endpoint from their page using the victim&#39;s browser as a relay.</p> <p>### Comparison with python-sdk No Access-Control-Allow-Origin header is emitted by either Python transport. The browser&#39;s default same-origin policy remains in full effect. https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/sse.py https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/streamable_http.py</p> <p>### Recommendation In the SDK, the transport layer should not own CORS policy. Server implementors who need cross-origin access can add a CORS filter at the servlet filter or Spring Security layer.</p> <p>### Reference</p> <p>- https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#access-control-allow-origin</p> https://cve.radiocsirt.org/vuln/ghsa-hv2w-8mjj-jw22