CVE-2026-45781
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their io.github.<user>/* namespace to OCI images they do not control. internal/validators/registries/oci.go:104-119 fails open on http.StatusTooManyRequests: when the registry's anonymous fetch to the upstream OCI registry is rate-limited, ValidateOCI returns nil and the publish is accepted without ever running the io.modelcontextprotocol.server.name label-match check at lines 122-141.
Risk Assessment
An attacker could take over an OCI namespace and publish malicious images impersonating trusted publishers. This may lead to delivery of malicious MCP servers to clients and compromise of supply chain trust.
Recommendation
Update MCP Registry to version 1.7.9 or later. Monitor OCI namespace publications for unauthorized changes.
Other vulnerabilities in MCP Registry
See all- CVE-2026-44428Medium
MCP Registry prior to 1.7.6 binds the GitHub OIDC flow only to a global audience string, not to the specific registry instance. A token obtained for one deployment is accepted by any other deployment sharing the same code and audience, allowing improper publish permission assignment. Fixed in 1.7.6.
- CVE-2026-44427Unknown
The MCP Registry (a registry of MCP servers for MCP clients) from 1.1.0 to 1.7.4 is vulnerable to an open redirect in the TrailingSlashMiddleware in internal/api/server.go. An attacker can craft a URL with a protocol-relative path (e.g., //evil.com/) that, after trailing slash removal, results in a Location header of //evil.com, which browsers interpret as an absolute URL to an external domain. The vulnerability is fixed in 1.7.5.
- CVE-2026-44430Medium
MCP Registry prior to 1.7.7 uses safeDialContext for HTTP-based namespace verification, but the blocklist does not cover IPv6 6to4, NAT64, or site-local addresses that can encode arbitrary IPv4 and tunnel to RFC1918 or cloud metadata services. This vulnerability is fixed in 1.7.7.
- CVE-2026-44429Medium
MCP Registry before 1.7.7 is vulnerable to stored cross-site scripting in the public catalogue UI (GET /) via the server.websiteUrl field of any published server.json. Server-side validation does not reject quote characters, and the value is interpolated into a double-quoted href attribute without proper encoding, allowing injection of arbitrary on* event handlers.
Original NVD description (English source)
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their io.github.<user>/* namespace to OCI images they do not control. internal/validators/registries/oci.go:104-119 fails open on http.StatusTooManyRequests: when the registry's anonymous fetch to the upstream OCI registry is rate-limited, ValidateOCI returns nil and the publish is accepted without ever running the io.modelcontextprotocol.server.name label-match check at lines 122-141. That label check is the only cross-system ownership proof the registry applies to OCI packages — every other registry type (NPM, PyPI, NuGet, MCPB) treats a non-200 upstream response as a hard error. This vulnerability is fixed in 1.7.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS