The MCP Registry performs HTTP requests during namespace verification to retrieve a public‑key file from publisher‑supplied domains. It intentionally rejects private or internal IPs, but its blocklist misses IPv6 6to4, NAT64, and deprecated site‑local prefixes that encode arbitrary IPv4 addresses. Consequently, an attacker can supply a domain that resolves to one of these special IPv6 addresses, causing the Registry to establish a connection that bypasses the intended private‑address filter. This SSRF allows unauthenticated access to internal or cloud‑metadata services, enabling information disclosure or lateral movement.

The vulnerability exists in the MCP Registry from modelcontextprotocol versions before 1.7.7, specifically the HTTP‑based namespace verification endpoints POST /v0/auth/http and POST /v0.1/auth/http. Any deployment of the Registry older than 1.7.7 that accepts external publisher domains is affected. The fix is included in release 1.7.7.

The CVSS score of 6.3 indicates a medium severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog. The attack requires an attacker to control or influence a publisher domain that resolves to a 6to4, NAT64, or site‑local IPv6 address; the request to the namespace verification endpoint is unauthenticated, so the vulnerability can be exploited from anywhere that can reach the Registry. If the Registry has outbound connectivity to internal networks, the SSRF can reach internal services, which could lead to sensitive data exposure or further exploitation. In environments where the Registry is exposed to untrusted domains, the risk is higher, and organizations should treat this as a moderate‑to‑high likelihood of internal compromise.