github.com/modelcontextprotocol/registry
Go5 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting github.com/modelcontextprotocol/registrypage 1 of 1
- CVE-2026-44427NONECVSS 0.0EG 0.0✓ Fixed in 1.7.52026-05-14
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. From 1.1.0 to 1.7.4, the TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft…
- CVE-2026-44428MEDIUMCVSS 4.7EG 4.7✓ Fixed in 1.7.62026-05-14
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry i…
- CVE-2026-44429MEDIUMCVSS 5.4EG 5.4✓ Fixed in 1.7.72026-05-14
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / (file internal/api/handlers/v0/ui_index.html) is vulnerable to stored cross-site s…
- CVE-2026-44430MEDIUMCVSS 4.0EG 4.0✓ Fixed in 1.7.72026-05-14
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Registry's HTTP-based namespace verification (POST /v0/auth/http, POST /v0.1/auth/http) uses safeDialContext (internal…
- CVE-2026-45781LOWCVSS 3.5EG 3.5✓ Fixed in 1.7.92026-05-14
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated pu…
Check whether github.com/modelcontextprotocol/registry is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for github.com/modelcontextprotocol/registry CVEs against the assets you own.
Start Free Scan →