Read the docs
TI-2026-32368 Aliases CVE-2026-44427GHSA-v8vw-gw5j-w7m6

MCP Registry: Open Redirect

Priority LOW 36CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. From 1.1.0 to 1.7.4, the TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft a URL with a protocol-relative path (e.g., //evil.com/) that, after trailing slash removal, results in a Location header of //evil.com — which browsers interpret as an absolute URL to an external domain. This vulnerability is fixed in 1.7.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0047 40th percentileScored 2026-11-07
Fix Fixed registry (modelcontextprotocol): 1.7.5github.com/modelcontextprotocol/registry (Go): 1.7.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MLflowregistry1.1.0 to before 1.7.51.7.5Patch availableCNA
—github.com/modelcontextprotocol/registry (Go)1.1.0 to before 1.7.51.7.5Patch availableGHSA-v8vw-gw5j-w7m6
  • registry VendorMLflow Affected 1.1.0 to before 1.7.5 Fixed in 1.7.5 Patch available CNA
  • github.com/modelcontextprotocol/registry (Go) Vendor— Affected 1.1.0 to before 1.7.5 Fixed in 1.7.5 Patch available GHSA-v8vw-gw5j-w7m6

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:lfprojects:mcp_registry:*:*:*:*:*:*:*:*——MLflow
  • cpe:2.3:a:lfprojects:mcp_registry:*:*:*:*:*:*:*:* Versions — — ·MLflow

Remediation

  • Fix · CNA registry (modelcontextprotocol) Fixed in 1.7.5
  • Fix · GHSA-v8vw-gw5j-w7m6 github.com/modelcontextprotocol/registry (Go) Fixed in 1.7.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44427
  2. 2026-10-03 Alias added: GHSA-v8vw-gw5j-w7m6

References

Advisory 1

Other 5

  • TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
  • TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
  • TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
  • TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
  • TI-2026-81527 Code execution via scorer deserialization in MLflow servers CVSS 3.1CRITICAL 9.8
  • TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
See all 175 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences