Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the hardcoded Access-Control-Allow-Origin: * header in the MCP Java SDK. This permissive Cross-Origin Resource Sharing (CORS) policy allows any website to make requests to the MCP server and read the responses. The analysis of the patches confirms this. By comparing the vulnerable versions with the patched versions (e.g., v1.1.0 vs. v1.1.1), I identified the commits that removed the vulnerable code. The commit diffs clearly show the removal of the line response.setHeader("Access-Control-Allow-Origin", "*"); from three key functions across two different files:
io.modelcontextprotocol.server.transport.HttpServletSseServerTransportProvider.doGet: This function handles Server-Sent Events (SSE) and was vulnerable to cross-origin read attacks.io.modelcontextprotocol.server.transport.HttpServletStreamableServerTransportProvider.doGet: This function handles GET requests for the streamable transport and was similarly vulnerable.io.modelcontextprotocol.server.transport.HttpServletStreamableServerTransportProvider.doPost: This function handles POST requests for the streamable transport, and the permissive CORS policy allowed an attacker's page to act as a relay for commands to the server.An attacker could exploit this by crafting a malicious web page that instructs a victim's browser to send requests to an internal MCP server. Due to the wildcard CORS policy, the attacker's page could read the responses, potentially capturing sensitive data like session IDs, and then use this information to send further malicious requests. The patch mitigates this by removing the hardcoded header, enforcing the browser's same-origin policy by default and delegating the responsibility of CORS configuration to the server implementor.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.modelcontextprotocol.sdk:mcp-core | maven | = 1.1.0 | 1.1.1 |
| io.modelcontextprotocol.sdk:mcp-core | maven | = 1.0.0 | 1.0.1 |
| io.modelcontextprotocol.sdk:mcp-core | maven | < 0.18.3 | 0.18.3 |