CVE-2026-44430
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
MCP Registry prior to 1.7.7 uses safeDialContext for HTTP-based namespace verification, but the blocklist does not cover IPv6 6to4, NAT64, or site-local addresses that can encode arbitrary IPv4 and tunnel to RFC1918 or cloud metadata services. This vulnerability is fixed in 1.7.7.
Risk Assessment
An attacker could bypass the private address blocklist and access internal services, including cloud metadata, potentially leading to data leakage or privilege escalation.
Recommendation
Upgrade MCP Registry to version 1.7.7, which fixes this vulnerability. Immediate patching is recommended.
Other vulnerabilities in MCP Registry
See all- CVE-2026-44428Medium
MCP Registry prior to 1.7.6 binds the GitHub OIDC flow only to a global audience string, not to the specific registry instance. A token obtained for one deployment is accepted by any other deployment sharing the same code and audience, allowing improper publish permission assignment. Fixed in 1.7.6.
- CVE-2026-44427Unknown
The MCP Registry (a registry of MCP servers for MCP clients) from 1.1.0 to 1.7.4 is vulnerable to an open redirect in the TrailingSlashMiddleware in internal/api/server.go. An attacker can craft a URL with a protocol-relative path (e.g., //evil.com/) that, after trailing slash removal, results in a Location header of //evil.com, which browsers interpret as an absolute URL to an external domain. The vulnerability is fixed in 1.7.5.
- CVE-2026-45781Low
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their io.github.<user>/* namespace to OCI images they do not control. internal/validators/registries/oci.go:104-119 fails open on http.StatusTooManyRequests: when the registry's anonymous fetch to the upstream OCI registry is rate-limited, ValidateOCI returns nil and the publish is accepted without ever running the io.modelcontextprotocol.server.name label-match check at lines 122-141.
- CVE-2026-44429Medium
MCP Registry before 1.7.7 is vulnerable to stored cross-site scripting in the public catalogue UI (GET /) via the server.websiteUrl field of any published server.json. Server-side validation does not reject quote characters, and the value is interpolated into a double-quoted href attribute without proper encoding, allowing injection of arbitrary on* event handlers.
Original NVD description (English source)
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Registry's HTTP-based namespace verification (POST /v0/auth/http, POST /v0.1/auth/http) uses safeDialContext (internal/api/handlers/v0/auth/http.go:67-110) to refuse dialling private/internal addresses when fetching the well-known public-key file from a publisher-supplied domain. The blocklist (isBlockedIP, lines 125-133) relies entirely on Go stdlib's IsLoopback / IsPrivate / IsLinkLocalUnicast / IsMulticast / IsUnspecified plus a manual CGNAT range. None of these cover IPv6 6to4 (2002::/16), NAT64 (64:ff9b::/96 and 64:ff9b:1::/48 per RFC 8215), or deprecated site-local (fec0::/10) — all of which encode arbitrary IPv4 in the address bits and tunnel to RFC1918 / cloud-metadata services on dual-stack / NAT64-enabled hosts. This vulnerability is fixed in 1.7.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS