Modelcontextprotocol Registry vulnerabilities

• modelcontextprotocol registry MCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attacker-controlled package claims CVE-2026-45781 Fix available 3.5 LowMay 14, 2026
• lfprojects mcp registry, modelcontextprotocol registry +1 more MCP Registry: Unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist CVE-2026-44430 Fix available 6.3 MediumMay 8, 2026
• lfprojects mcp registry, modelcontextprotocol registry +1 more MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` CVE-2026-44429 Fix available 5.1 MediumMay 8, 2026
• lfprojects mcp registry, modelcontextprotocol registry +1 more MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience CVE-2026-44428 Fix available 2.1 LowMay 8, 2026
• modelcontextprotocol registry MCP Registry: Open Redirect CVE-2026-44427 Fix available 0.0 NoneMay 8, 2026