Vulnerabilities

TI-2026-32369 CVE-2026-44428 · GHSA-95c3-6vvw-4mrq

MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience

LOW 11

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00219 Published 2026-05-14 Fixed in 1.7.6 CWE-918

TI-2026-32370 CVE-2026-44429 · GHSA-rqv2-m695-f8j4

MEDIUM 56

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00167 Published 2026-05-14 Fixed in 1.7.7 CWE-116

TI-2026-32371 CVE-2026-44430 · GHSA-r48c-v28r-pf6v

MEDIUM 61

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00285 Published 2026-05-14 Fixed in 1.7.7 CWE-918