CVE-2026-44428
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
MCP Registry prior to 1.7.6 binds the GitHub OIDC flow only to a global audience string, not to the specific registry instance. A token obtained for one deployment is accepted by any other deployment sharing the same code and audience, allowing improper publish permission assignment. Fixed in 1.7.6.
Risk Assessment
An OIDC token legitimately obtained in one registry can be used to publish to another deployment, breaking isolation and access control. This may lead to unauthorized package publication.
Recommendation
Update MCP Registry to version 1.7.6 or later. Until updated, consider limiting trust between registry deployments.
Other vulnerabilities in MCP Registry
See all- CVE-2026-44427Unknown
The MCP Registry (a registry of MCP servers for MCP clients) from 1.1.0 to 1.7.4 is vulnerable to an open redirect in the TrailingSlashMiddleware in internal/api/server.go. An attacker can craft a URL with a protocol-relative path (e.g., //evil.com/) that, after trailing slash removal, results in a Location header of //evil.com, which browsers interpret as an absolute URL to an external domain. The vulnerability is fixed in 1.7.5.
- CVE-2026-45781Low
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their io.github.<user>/* namespace to OCI images they do not control. internal/validators/registries/oci.go:104-119 fails open on http.StatusTooManyRequests: when the registry's anonymous fetch to the upstream OCI registry is rate-limited, ValidateOCI returns nil and the publish is accepted without ever running the io.modelcontextprotocol.server.name label-match check at lines 122-141.
- CVE-2026-44430Medium
MCP Registry prior to 1.7.7 uses safeDialContext for HTTP-based namespace verification, but the blocklist does not cover IPv6 6to4, NAT64, or site-local addresses that can encode arbitrary IPv4 and tunnel to RFC1918 or cloud metadata services. This vulnerability is fixed in 1.7.7.
- CVE-2026-44429Medium
MCP Registry before 1.7.7 is vulnerable to stored cross-site scripting in the public catalogue UI (GET /) via the server.websiteUrl field of any published server.json. Server-side validation does not reject quote characters, and the value is interpolated into a double-quoted href attribute without proper encoding, allowing injection of arbitrary on* event handlers.
Original NVD description (English source)
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client side, the publisher always appends audience=mcp-registry when requesting the GitHub Actions ID token, regardless of the selected --registry URL. On the server side, the exchange endpoint validates only that same fixed audience and then derives publish permissions directly from repository_owner. As a result, a token legitimately obtained while interacting with one registry deployment remains acceptable to any other deployment that shares the same code and audience string. This vulnerability is fixed in 1.7.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS