CVE-2026-35568: lfprojects mcp java sdk

csirt@kutim:~/threat-intel/cve/CVE-2026-35568

CVSS 5.7 · Medium EPSS 0,20%

Kerentanan Origin Validation Error pada lfprojects mcp java sdk. Skor CVSS 3.1 5.7 (Medium) menurut NVD.

Deskripsi (NVD)

MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to 1.0.0, the java-sdk contains a DNS rebinding vulnerability. This vulnerability allows an attacker to access a locally or network-private java-sdk MCP server via a victims browser that is either local, or network adjacent. This allows an attacker to make any tool call to the server as if they were a locally running MCP connected AI agent. This vulnerability is fixed in 1.0.0.

Rincian

Terbit di NVD: 7 April 2026
Terakhir diubah: 24 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 5.7 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-346: Origin Validation Error
EPSS (30 hari): 0,20% peluang dieksploitasi; lebih tinggi dari 9,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
lfprojects	mcp java sdk	Semua versi sebelum 1.0.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-8jxr-pr72-r468 advisory vendor
https://github.com/modelcontextprotocol/java-sdk/releases/tag/v1.0.0 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.