{"id":"EUVD-2026-30489","enisaUuid":"30d62aaf-ef85-3f8e-91f0-9fa66582d5b5","description":"The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their io.github.\u003cuser\u003e/* namespace to OCI images they do not control. internal/validators/registries/oci.go:104-119 fails open on http.StatusTooManyRequests: when the registry\u0027s anonymous fetch to the upstream OCI registry is rate-limited, ValidateOCI returns nil and the publish is accepted without ever running the io.modelcontextprotocol.server.name label-match check at lines 122-141. That label check is the only cross-system ownership proof the registry applies to OCI packages — every other registry type (NPM, PyPI, NuGet, MCPB) treats a non-200 upstream response as a hard error. This vulnerability is fixed in 1.7.9.","datePublished":"May 14, 2026, 9:00:49 PM","dateUpdated":"May 16, 2026, 1:06:38 AM","baseScore":3.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","references":"https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-2v5f-5r6w-p67r\n","aliases":"CVE-2026-45781\nGHSA-2v5f-5r6w-p67r\n","assigner":"GitHub_M","epss":0.23,"enisaIdProduct":[{"id":"52539231-656e-3794-87b9-732c76a509e3","product":{"name":"registry","vendor":{"name":"modelcontextprotocol"}},"product_version":"\u003c 1.7.9"}],"enisaIdVendor":[{"id":"643b0215-4223-328e-9c03-b9bb0f5d0f92","vendor":{"name":"modelcontextprotocol"}}],"enisaIdVulnerability":[{"id":"b6609d9b-1597-31c7-af03-c2945ca06d7d","vulnerability":{"id":"GHSA-2v5f-5r6w-p67r","description":"MCP Registry: OCI validator skips ownership check on upstream rate limits","datePublished":"May 19, 2026, 3:39:55 PM","dateUpdated":"May 19, 2026, 3:39:56 PM","baseScore":0.0,"references":"https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-2v5f-5r6w-p67r\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45781\nhttps://github.com/modelcontextprotocol/registry\n","enisa_id":"EUVD-2026-30489\n","aliases":"CVE-2026-45781\nGHSA-2v5f-5r6w-p67r\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d94a9073-f235-398a-a077-4177d50a067e","vulnerability":{"id":"CVE-2026-45781","description":"The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their io.github.\u003cuser\u003e/* namespace to OCI images they do not control. internal/validators/registries/oci.go:104-119 fails open on http.StatusTooManyRequests: when the registry\u0027s anonymous fetch to the upstream OCI registry is rate-limited, ValidateOCI returns nil and the publish is accepted without ever running the io.modelcontextprotocol.server.name label-match check at lines 122-141. That label check is the only cross-system ownership proof the registry applies to OCI packages — every other registry type (NPM, PyPI, NuGet, MCPB) treats a non-200 upstream response as a hard error. This vulnerability is fixed in 1.7.9.","datePublished":"May 14, 2026, 9:00:49 PM","dateUpdated":"May 16, 2026, 1:06:38 AM","status":"PUBLISHED","baseScore":3.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","references":"https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-2v5f-5r6w-p67r\n","enisa_id":"EUVD-2026-30489\n","assigner":"GitHub_M","epss":0.23,"dataProcessed":"Oct 28, 2026, 7:17:09 AM","vulnerabilityProduct":[{"id":"468dc109-887a-36d4-ad76-bc60e4cfed3b","product":{"name":"registry","vendor":{"name":"modelcontextprotocol"}},"product_version":"\u003c 1.7.9"}],"vulnerabilityVendor":[{"id":"71f4abd7-b24b-38c0-b9d3-c197ba3eccd5","vendor":{"name":"modelcontextprotocol"}}]}}],"enisaIdAdvisory":[]}