MCP Registry vulnerabilities

MCP Registry prior to 1.7.6 binds the GitHub OIDC flow only to a global audience string, not to the specific registry instance. A token obtained for one deployment is accepted by any other deployment sharing the same code and audience, allowing improper publish permission assignment. Fixed in 1.7.6.

The MCP Registry (a registry of MCP servers for MCP clients) from 1.1.0 to 1.7.4 is vulnerable to an open redirect in the TrailingSlashMiddleware in internal/api/server.go. An attacker can craft a URL with a protocol-relative path (e.g., //evil.com/) that, after trailing slash removal, results in a Location header of //evil.com, which browsers interpret as an absolute URL to an external domain. The vulnerability is fixed in 1.7.5.

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their io.github.<user>/* namespace to OCI images they do not control. internal/validators/registries/oci.go:104-119 fails open on http.StatusTooManyRequests: when the registry's anonymous fetch to the upstream OCI registry is rate-limited, ValidateOCI returns nil and the publish is accepted without ever running the io.modelcontextprotocol.server.name label-match check at lines 122-141.

MCP Registry prior to 1.7.7 uses safeDialContext for HTTP-based namespace verification, but the blocklist does not cover IPv6 6to4, NAT64, or site-local addresses that can encode arbitrary IPv4 and tunnel to RFC1918 or cloud metadata services. This vulnerability is fixed in 1.7.7.

MCP Registry before 1.7.7 is vulnerable to stored cross-site scripting in the public catalogue UI (GET /) via the server.websiteUrl field of any published server.json. Server-side validation does not reject quote characters, and the value is interpolated into a double-quoted href attribute without proper encoding, allowing injection of arbitrary on* event handlers.