DNS Rebinding Vulnerability in MCP Java SDK <1.0.0
CVE-2026-35568 Published on April 7, 2026

MCP Java-SDK has a DNS Rebinding Vulnerability
MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to 1.0.0, the java-sdk contains a DNS rebinding vulnerability. This vulnerability allows an attacker to access a locally or network-private java-sdk MCP server via a victims browser that is either local, or network adjacent. This allows an attacker to make any tool call to the server as if they were a locally running MCP connected AI agent. This vulnerability is fixed in 1.0.0.

NVD

Weakness Type

Origin Validation Error

The software does not properly verify that the source of data or communication is valid.


Affected Versions

modelcontextprotocol java-sdk Version < 1.0.0 is affected by CVE-2026-35568

Exploit Probability

EPSS
0.03%
Percentile
6.82%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.