6.1

CVE-2026-34237: lfprojects mcp_java_sdk

CVSS: 6.1v3.1MediumModified
AliasesCGA-3pqm-cvjx-3xqfCGA-542f-52h9-p3g3CGA-697p-27x4-m8m9
Published 31-03-2026Last modified 09-06-2026
Open JSON

Vulnerability summary

CVE-2026-34237 is a medium (CVSS 6.1) vulnerability in lfprojects mcp_java_sdk. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.4% of scored vulnerabilities.

Overall risk
24/100
0100
Low · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.31%
0%100%
Low · +0.09 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-RPQR-576X-6RXX

Timeline

  1. 31-03-2026
    PublishedVulnerability first disclosed.
  2. 09-06-2026
    Last modifiedVulnerability information updated.

Description

MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.31%

Chance of exploitation in the next 30 days

Percentile

22%

Versus all other CVEs

30-day change

+0.09 pp

From 0.22% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.31%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard4 products
  • camunda-8.9< 8.9.1-r0
  • camunda-zeebe-8.9< 8.9.1-r0
  • nacos< 3.2.0-r6
  • nacos-docker< 3.2.0-r2
Io.modelcontextprotocol.sdk1 product
  • mcp-core≥ 1.0.0, < 1.0.1 | ≥ 1.1.0, < 1.1.1 | < 0.18.3
Lfprojects1 product
Modelcontextprotocol1 product
  • java-sdk≥ 1.0.0, < 1.0.1 | ≥ 1.1.0, < 1.1.1 | < 0.18.3

4 vendors · 7 products

References

7 links