CVE-2026-35568 — MCP Java-SDK has a DNS Rebinding Vulnerability
MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to 1.0.0, the java-sdk contains a DNS rebinding vulnerability. This vulnerability all…
Published: 2026-04-07 · CVSS: 7.6 · CVSS 4.0
MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to 1.0.0, the java-sdk contains a DNS rebinding vulnerability. This vulnerability allows an attacker to access a locally or network-private java-sdk MCP server via a victims browser that is either local, or network adjacent. This allows an attacker to make any tool call to the server as if they were a locally running MCP connected AI agent. This vulnerability is fixed in 1.0.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7