PT-2026-39261 · Unknown · Mcp Registry

Gujasec · Published 2026-05-08 · Updated 2026-05-15 · CVE-2026-44427

Positive Technologies (AI Summary)

CVSS v4.0

5.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions MCP Registry versions 1.1.0 through 1.7.4

Description The TrailingSlashMiddleware in internal/api/server.go is susceptible to an open redirect. This occurs because the middleware strips trailing slashes from request paths and issues a 308 Permanent Redirect to the cleaned path without validating or sanitizing the resulting path. An attacker can craft a URL using a protocol-relative path (e.g., //evil.com/), which results in a Location header of //evil.com that browsers interpret as an absolute URL to an external domain. This can be leveraged for phishing, malware distribution, and abusing the trust of the official domain.

Recommendations Update to version 1.7.5.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-44427

GHSA-V8VW-GW5J-W7M6

Affected Products

Mcp Registry

References · 9

• 🔥 https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-v8vw-gw5j-w7m6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44427 · Security Note
• https://osv.dev/vulnerability/GHSA-v8vw-gw5j-w7m6 · Vendor Advisory
• https://github.com/modelcontextprotocol/registry · Note
• https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.5 · Note
• https://github.com/modelcontextprotocol/registry/pull/1227 · Note
• https://github.com/modelcontextprotocol/registry/commit/1201cbd82b2cf6d4b56edfc05c763059a12f9fdb · Note
• https://twitter.com/CVEnew/status/2055074216890843575 · Twitter Post
• https://t.me/CVEtracker/53847 · Telegram Post