Open Redirect Vulnerability in MCP Registry Affects Model Context Protocol
CVE-2026-44427

NONE

Key Information:

Vendor

Modelcontextprotocol

Status
Registry
Vendor
CVE Published:
14 May 2026

What is CVE-2026-44427?

The MCP Registry is susceptible to an open redirect attack due to a flaw in the TrailingSlashMiddleware component. Versions 1.1.0 through 1.7.4 include a vulnerability that allows an attacker to manipulate URLs with protocol-relative paths, resulting in a Location header redirection to an external domain. This enables malicious actors to redirect users to potentially harmful sites while bypassing browser security measures. The issue has been remedied in version 1.7.5, making it imperative for users to update to the latest version to ensure their security.

Affected Version(s)

registry >= 1.1.0, < 1.7.5

References

https://github.com/modelcontextprotocol/registry/security...
x_refsource_CONFIRM

CVSS V4

Score:
Severity:
NONE
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.