Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2026-44430— MCP Registry: Unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist

AI Predicted 9.0 Difficulty: Moderate EPSS 0.03% · P8

Possible ATT&CK Techniques 1AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProductVersion RangeStatus
modelcontextprotocolregistry< 1.7.7affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-44430

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MCP Registry: Unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist
Source: NVD (National Vulnerability Database)
Vulnerability Description
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Registry's HTTP-based namespace verification (POST /v0/auth/http, POST /v0.1/auth/http) uses safeDialContext (internal/api/handlers/v0/auth/http.go:67-110) to refuse dialling private/internal addresses when fetching the well-known public-key file from a publisher-supplied domain. The blocklist (isBlockedIP, lines 125-133) relies entirely on Go stdlib's IsLoopback / IsPrivate / IsLinkLocalUnicast / IsMulticast / IsUnspecified plus a manual CGNAT range. None of these cover IPv6 6to4 (2002::/16), NAT64 (64:ff9b::/96 and 64:ff9b:1::/48 per RFC 8215), or deprecated site-local (fec0::/10) — all of which encode arbitrary IPv4 in the address bits and tunnel to RFC1918 / cloud-metadata services on dual-stack / NAT64-enabled hosts. This vulnerability is fixed in 1.7.7.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
服务端请求伪造(SSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Title
MCP Registry 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MCP Registry是Model Context Protocol开源的一个MCP服务器应用商店。 MCP Registry 1.7.7之前版本存在代码问题漏洞，该漏洞源于基于HTTP的命名空间验证使用safeDialContext拒绝拨号私有/内部地址，但阻止列表未覆盖IPv6 6to4、NAT64或已弃用的站点本地地址，这些地址可编码任意IPv4并隧道到RFC1918或云元数据服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
modelcontextprotocolregistry < 1.7.7 -

II. Public POCs for CVE-2026-44430

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-44430

请登录查看更多情报信息。

Same Patch Batch · modelcontextprotocol · 2026-05-14 · 6 CVEs total

CVE-2026-425598.8 HIGHRMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport
CVE-2026-457813.5 LOWMCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attack
CVE-2026-44429MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-control
CVE-2026-44427MCP Registry: Open Redirect
CVE-2026-44428MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audi

IV. Related Vulnerabilities

Same product: registry
Same vendor: modelcontextprotocol
Same weakness: CWE-918

V. Comments for CVE-2026-44430

No comments yet

Leave a comment