PT-2026-39262 · Unknown · Mcp Registry

Forimoc · Published 2026-05-08 · Updated 2026-05-15 · CVE-2026-44428

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MCP Registry versions prior to 1.7.6

Description The GitHub OIDC flow for both client and server is bound to a global audience string instead of the specific registry instance being targeted. On the client side, the publisher always appends audience=mcp-registry when requesting the GitHub Actions ID token, regardless of the --registry URL selected. On the server side, the exchange endpoint '/v0/auth/github-oidc' validates only this fixed audience and derives publish permissions directly from the repository owner variable. Consequently, a token obtained for one registry deployment can be replayed to any other deployment sharing the same code and audience string, allowing an attacker-controlled or compromised registry to impersonate a GitHub owner identity and perform unauthorized publication or update actions.

Recommendations Update to version 1.7.6.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-44428

GHSA-95C3-6VVW-4MRQ

Affected Products

Mcp Registry

References · 9

• https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-95c3-6vvw-4mrq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44428 · Security Note
• https://osv.dev/vulnerability/GHSA-95c3-6vvw-4mrq · Vendor Advisory
• https://github.com/modelcontextprotocol/registry · Note
• https://github.com/modelcontextprotocol/registry/commit/3f89fc2b1fb34fd49f3c0e1b39e964a5c67b613f · Note
• https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.6 · Note
• https://github.com/modelcontextprotocol/registry/pull/1229 · Note
• https://twitter.com/CVEnew/status/2055074215590494621 · Twitter Post
• https://t.me/CVEtracker/53848 · Telegram Post