Java-SDK 存在 DNS 重绑定漏洞

The core of this vulnerability lies in the lack of Origin header validation prior to version 1.0.0. This omission violates the Model Context Protocol (MCP) specification. An attacker can leverage DNS rebinding to trick a victim's browser into believing it's communicating with a legitimate, locally-trusted MCP server, when in reality, it's connecting to a server controlled by the attacker. This allows the attacker to execute arbitrary tool calls to the MCP server as if they were a locally running AI agent. The potential impact is significant, as an attacker could exfiltrate sensitive data, manipulate system behavior, or even gain a foothold for further attacks within the affected environment. While no direct precedent is cited, the technique shares similarities with other DNS rebinding attacks that have been used to bypass security measures and gain unauthorized access.

Organizations deploying applications that utilize the io.modelcontextprotocol.sdk (mcp-core) library, particularly those with network-adjacent deployments or where user browsers have access to both local and remote resources, are at risk. Shared hosting environments where multiple users share the same MCP server are also particularly vulnerable.

• java / server: Monitor application logs for requests with unexpected or missing Origin headers.

grep 'Origin:' /path/to/application.log | sort | uniq -c | sort -nr

• generic web: Use curl to test endpoint exposure and examine response headers for the Origin header.

curl -I https://your-mcp-server/api/endpoint

• generic web: Check access/error logs for unusual patterns related to DNS resolution and requests from unexpected IP addresses.

1. 2026-04-07Disclosure

   disclosure

1. 已保留2026-04-03
2. 发布日期2026-04-07
3. 修改日期2026-04-15
4. EPSS 更新日期2026-04-15

The primary mitigation for CVE-2026-35568 is to immediately upgrade to version 1.0.0 of the io.modelcontextprotocol.sdk (mcp-core). This version includes the necessary Origin header validation to prevent DNS rebinding attacks. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) or reverse proxy with rules to strictly validate the Origin header and block requests with unexpected or invalid values. Additionally, review your network configuration to ensure that MCP servers are not exposed to untrusted networks. There are no specific Sigma or YARA rules available at this time, but monitoring for unusual Origin header values in your logs is recommended.