MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist
Moderate severity
GitHub Reviewed
Published
May 4, 2026
in
modelcontextprotocol/registry
•
Updated May 15, 2026
Give feedback on Dependabot alerts