The MCP Registry provides clients with a list of MCP servers and performs HTTP-based namespace verification by fetching a public-key file from publisher-supplied domains. Before version 1.7.7, the verification logic uses a blocklist relying on Go standard library IP checks and a manual CGNAT range to block private/internal IP addresses. However, this blocklist does not cover IPv6 6to4 (2002::/16), NAT64 (64:ff9b::/96 and 64:ff9b:1::/48), or deprecated site-local (fec0::/10) address ranges, which can tunnel to private IPv4 or cloud metadata services. This gap allows SSRF attacks by bypassing the IP blocklist. The vulnerability is addressed in version 1.7.7.

An attacker can exploit this vulnerability to perform SSRF attacks by bypassing the IP address blocklist during namespace verification. This could allow unauthorized access to internal or cloud metadata services that are normally protected by IP filtering. The CVSS 4.0 score is 6.3 (medium severity), indicating a moderate impact with network attack vector, low attack complexity, and no privileges or user interaction required.

Upgrade the modelcontextprotocol registry to version 1.7.7 or later, where this vulnerability is fixed. Patch status is not explicitly stated in the vendor advisory, but the description confirms the issue is resolved in 1.7.7. Until upgrading, be aware that the IP blocklist does not cover certain IPv6 ranges, which can be exploited for SSRF.