The MCP Registry’s TrailingSlashMiddleware in internal/api/server.go can alter a protocol‑relative URL, turning a string such as //evil.com/ into a Location header of //evil.com after trailing‑slash removal. Browsers interpret this as an absolute URL to an external domain, allowing an attacker to redirect users to a malicious site while presenting it as a legitimate MCP server. This flaw requires no authentication and can be triggered simply by visiting a crafted link.

The affected product is MCP Registry by modelcontextprotocol, with versions 1.1.0 through 1.7.4 susceptible to the vulnerability. The fix is incorporated beginning with version 1.7.5.

Because the flaw is an open redirect, its exploitation is low effort and relies on user interaction. The EPSS score is not published, and the vulnerability is not listed in CISA’s KEV catalog, but the potential for phishing remains significant. Applying the 1.7.5 update removes the redirect bug; no additional access privileges are required for exploitation.