Read the docs
TI-2026-32371 Aliases CVE-2026-44430GHSA-r48c-v28r-pf6v

Server-side request forgery in MLflow registry

Priority MEDIUM 61CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Registry's HTTP-based namespace verification (POST /v0/auth/http, POST /v0.1/auth/http) uses safeDialContext (internal/api/handlers/v0/auth/http.go:67-110) to refuse dialling private/internal addresses when fetching the well-known public-key file from a publisher-supplied domain. The blocklist (isBlockedIP, lines 125-133) relies entirely on Go stdlib's IsLoopback / IsPrivate / IsLinkLocalUnicast / IsMulticast / IsUnspecified plus a manual CGNAT range. None of these cover IPv6 6to4 (2002::/16), NAT64 (64:ff9b::/96 and 64:ff9b:1::/48 per RFC 8215), or deprecated site-local (fec0::/10) — all of which encode arbitrary IPv4 in the address bits and tunnel to RFC1918 / cloud-metadata services on dual-stack / NAT64-enabled hosts. This vulnerability is fixed in 1.7.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00285 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed registry (modelcontextprotocol): 1.7.7github.com/modelcontextprotocol/registry (Go): 1.7.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MLflowregistrybefore 1.7.71.7.7Patch availableCNA
—github.com/modelcontextprotocol/registry (Go)before 1.7.71.7.7Patch availableGHSA-r48c-v28r-pf6v
  • registry VendorMLflow Affected before 1.7.7 Fixed in 1.7.7 Patch available CNA
  • github.com/modelcontextprotocol/registry (Go) Vendor— Affected before 1.7.7 Fixed in 1.7.7 Patch available GHSA-r48c-v28r-pf6v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lfprojects:mcp_registry:*:*:*:*:*:*:*:*before 1.7.7VulnerableMLflow
  • cpe:2.3:a:lfprojects:mcp_registry:*:*:*:*:*:*:*:* Versions before 1.7.7 Vulnerable ·MLflow

Remediation

  • Fix · CNA registry (modelcontextprotocol) Fixed in 1.7.7
  • Fix · GHSA-r48c-v28r-pf6v github.com/modelcontextprotocol/registry (Go) Fixed in 1.7.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44430
  2. 2026-10-03 Alias added: GHSA-r48c-v28r-pf6v

References

Exploit 1

Advisory 1

Other 4

  • TI-2026-32370 MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` CVSS 4.0MEDIUM 5.1
  • TI-2026-32369 MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience CVSS 4.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences