MCP Registry Open Redirect (CVE-2026-44427)

TL;DR: The official Model Context Protocol registry (registry.modelcontextprotocol.io) had an open redirect bug in its trailing-slash middleware. A protocol-relative path like //evil.com/ got echoed straight into the Location header of a 308 Permanent Redirect, sending users to an attacker-controlled domain while the URL still started with the trusted registry host. Reported, fixed in v1.7.5, and assigned CVE-2026-44427.

Background

The modelcontextprotocol/registry project runs a TrailingSlashMiddleware in internal/api/server.go whose job is simple: if a request path has a trailing slash, strip it and 308-redirect the client to the clean version. Standard, boring, and usually harmless — right up until the “clean” path isn’t actually validated before being reused as the redirect target.

The Bug

The middleware took the request path, stripped the trailing slash, and dropped the result directly into the Location header — no check for whether the path was still a relative path.

A protocol-relative URL like //evil.com/ is technically a valid path from the router’s point of view. Strip its trailing slash and you’re left with //evil.com. Browsers treat any URL starting with // as protocol-relative — meaning Location: //evil.com is resolved to https://evil.com, not to any path on the registry itself.

PoC

curl -v https://<registry-host>//evil.com/

Response:

HTTP/2 308 Permanent Redirect
Content-Type: text/html; charset=utf-8
Location: //evil.com

Followed in a browser, that request lands the user on https://evil.com — while the link they clicked visibly started with the trusted registry domain.

Impact

• Phishing — attackers can wrap credential-harvesting pages behind a link that starts with the trusted registry domain, since the redirect happens server-side after the click.
• Malware distribution — the same mechanism works for pushing users toward malicious downloads.
• Trust abuse — links from the official MCP Registry carry implicit trust that this bug lets an attacker borrow.

Reported and fixed under GHSA-v8vw-gw5j-w7m6. CVE-2026-44427.