CVE-2026-44430
2 advisories.
Go/github.com/modelcontextprotocol/registry CVE-2026-44430: medium 4
MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist
Action: Upgrade github.com/modelcontextprotocol/registry to 1.7.7 or later.
go get github.com/modelcontextprotocol/registry@v1.7.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.7.7 | - |
Fixed versions
| 1.7.7 |
Sources
- osv: GHSA-r48c-v28r-pf6v
- https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-r48c-v28r-pf6v
- https://nvd.nist.gov/vuln/detail/CVE-2026-44430
- https://github.com/modelcontextprotocol/registry/pull/1250
- https://github.com/modelcontextprotocol/registry/commit/f5f40bd98084466eaf18fe48ea62a0d534caa774
- https://github.com/modelcontextprotocol/registry
- https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.7
CVE-2026-44430 · published · modified · JSON
Go/github.com/modelcontextprotocol/registry CVE-2026-44430: unknown
MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
Action: Upgrade github.com/modelcontextprotocol/registry to 1.7.7 or later.
go get github.com/modelcontextprotocol/registry@v1.7.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.7.7 | - |
Fixed versions
| 1.7.7 |
Sources
- osv: GO-2026-5607
- https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-r48c-v28r-pf6v
- https://nvd.nist.gov/vuln/detail/CVE-2026-44430
- https://github.com/modelcontextprotocol/registry/commit/f5f40bd98084466eaf18fe48ea62a0d534caa774
- https://github.com/modelcontextprotocol/registry/pull/1250
- https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.7
CVE-2026-44430 · published · modified · JSON