An MCP server's host allowlist regex missing an end anchor lets any lookalike domain through

GitHub Security Advisories·low signalXBlueskyLinkedInCopy link

GHSA-83x6-42hr-jc76 (CVSS 5.3) covers the CKAN MCP Server, where ckan_get_mqa_quality and ckan_get_mqa_quality_details restrict server_url to dati.gov.it using a regex anchored only at the start with no boundary after the host. Any URL whose host merely begins with dati.gov.it, such as dati.gov.it.attacker.com, or that uses it as userinfo before an @, passes validation while targeting an attacker-controlled host. It is a small bug worth naming because host-allowlist regexes are the default way MCP server authors constrain outbound tool arguments, and this is the exact shape that keeps failing.