Open Redirect in Modelcontextprotocol Registry
CVE-2026-44427
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. From 1.1.0 to 1.7.4, the TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft…
Vulnerability class: Open Redirect
EPSS: 0.000 (4.6th percentile) — read the EPSS interpretation.
Affected products
- Modelcontextprotocol Registry — versions >= 1.1.0, < 1.7.5
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)