CVE-2026-44427
UnknownCVSS 0.0Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
The MCP Registry (a registry of MCP servers for MCP clients) from 1.1.0 to 1.7.4 is vulnerable to an open redirect in the TrailingSlashMiddleware in internal/api/server.go. An attacker can craft a URL with a protocol-relative path (e.g., //evil.com/) that, after trailing slash removal, results in a Location header of //evil.com, which browsers interpret as an absolute URL to an external domain. The vulnerability is fixed in 1.7.5.
Risk Assessment
An attacker can redirect users to a malicious domain, facilitating phishing and credential theft. The risk affects users and integrations relying on MCP Registry.
Recommendation
Update MCP Registry to version 1.7.5 or later. Until updated, consider validating Location headers and limiting trust in redirects from this component.
Other vulnerabilities in MCP Registry
See all- CVE-2026-44428Medium
MCP Registry prior to 1.7.6 binds the GitHub OIDC flow only to a global audience string, not to the specific registry instance. A token obtained for one deployment is accepted by any other deployment sharing the same code and audience, allowing improper publish permission assignment. Fixed in 1.7.6.
- CVE-2026-45781Low
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their io.github.<user>/* namespace to OCI images they do not control. internal/validators/registries/oci.go:104-119 fails open on http.StatusTooManyRequests: when the registry's anonymous fetch to the upstream OCI registry is rate-limited, ValidateOCI returns nil and the publish is accepted without ever running the io.modelcontextprotocol.server.name label-match check at lines 122-141.
- CVE-2026-44430Medium
MCP Registry prior to 1.7.7 uses safeDialContext for HTTP-based namespace verification, but the blocklist does not cover IPv6 6to4, NAT64, or site-local addresses that can encode arbitrary IPv4 and tunnel to RFC1918 or cloud metadata services. This vulnerability is fixed in 1.7.7.
- CVE-2026-44429Medium
MCP Registry before 1.7.7 is vulnerable to stored cross-site scripting in the public catalogue UI (GET /) via the server.websiteUrl field of any published server.json. Server-side validation does not reject quote characters, and the value is interpolated into a double-quoted href attribute without proper encoding, allowing injection of arbitrary on* event handlers.
Original NVD description (English source)
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. From 1.1.0 to 1.7.4, the TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft a URL with a protocol-relative path (e.g., //evil.com/) that, after trailing slash removal, results in a Location header of //evil.com — which browsers interpret as an absolute URL to an external domain. This vulnerability is fixed in 1.7.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS