Executive brief
The Model Context Protocol (MCP) Registry, a service used for managing and verifying namespaces, contains a security flaw in how it validates server addresses. An unauthenticated attacker can trick the registry into making network requests to internal infrastructure, such as cloud metadata services or private databases, by using specific IPv6 address formats. This could lead to the exposure of sensitive internal configuration data or credentials, potentially compromising the security of the hosting environment.
Technical details
A Server-Side Request Forgery (SSRF) exists in the `POST /v0/auth/http` and `POST /v0.1/auth/http` endpoints of the MCP Registry. The `isBlockedIP` function in `internal/api/handlers/v0/auth/http.go` relies on standard Go library helpers that do not filter IPv6 prefixes used for embedding IPv4 addresses, specifically 6to4 (2002::/16), NAT64 (64:ff9b::/96), and deprecated site-local (fec0::/10) addresses. An unauthenticated attacker can provide a domain resolving to these prefixes to bypass the private-address allowlist and reach internal RFC1918 or cloud metadata services (e.g., 169.254.169.254) on dual-stack or NAT64-enabled hosts. The vulnerability is exploitable because the network dial occurs before signature verification. The issue is patched in version 1.7.7.
Affected products
- modelcontextprotocol registry < 1.7.7
Timeline
- 2026-05-04: advisory: GitHub Advisory GHSA-r48c-v28r-pf6v published
- 2026-05-08: disclosed
- 2026-05-15: patched: Version 1.7.7 released