Skip to content
OpenAdvisories

Package · Go

github.com/modelcontextprotocol/registry

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 2.1
    CVE-2026-44428

    MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience

    The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being target…

    modelcontextprotocol registry github.com/modelcontextprotocol/registry Go
  • Low 3.5
    CVE-2026-45781

    MCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attacker-controlled package claims

    The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their i…

    modelcontextprotocol registry github.com/modelcontextprotocol/registry Go