What’s Vulnerable › Products

modelcontextprotocol registry vulnerabilities

5 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your modelcontextprotocol registry version is affected

Latest modelcontextprotocol registry vulnerabilities

• CVE-2026-44428 — MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience (CVSS 4.7)
• CVE-2026-44427 — MCP Registry: Open Redirect (CVSS 0.0)
• CVE-2026-45781 — MCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attacker-controlled package claims (CVSS 3.5)
• CVE-2026-44430 — MCP Registry: Unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist (CVSS 4.0)
• CVE-2026-44429 — MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` (CVSS 5.4)