2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44428

CVE-2026-44428: MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client side, the publisher always appends audience=mcp-registry when requesting the GitHub Actions ID token, regardless of the selected --registry URL. On the server side, the exchange endpoint validates only that same fixed audience and then derives publish permissions directly from repository_owner. As a result, a token legitimately obtained while interacting with one registry deployment remains acceptable to any other deployment that shares the same code and audience string. This vulnerability is fixed in 1.7.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44428

CVE-2026-44428:

2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/modelcontextprotocol/registry	go	< 1.7.6	1.7.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The root cause of the vulnerability is the use of a shared, hardcoded audience string (mcp-registry) for the GitHub OIDC authentication flow on both the client and server sides. On the client-side (mcp-publisher), the GitHubOIDCProvider.getOIDCTokenFromGitHub function always requested a token from GitHub with audience=mcp-registry, regardless of the actual --registry URL being targeted. The GitHubOIDCProvider.GetToken function orchestrated this flawed request. On the server-side, the GitHubOIDCHandler.ExchangeToken function validated incoming OIDC tokens against the same hardcoded audience. This allowed an OIDC token legitimately obtained for one registry instance to be replayed to another. The target registry would accept the token because the audience matched its static expectation, improperly granting publishing permissions. The patch remediates this by making the audience dynamic and registry-specific. The client now derives the audience from the registry's URL, and the server validates against a per-deployment configuration value, ensuring tokens are bound to a specific registry instance.

Vulnerable functions

GitHubOIDCProvider.getOIDCTokenFromGitHub

cmd/publisher/auth/github-oidc.go

This function, prior to the patch, constructed the OIDC token request to GitHub using a hardcoded audience ('mcp-registry'). This meant that regardless of the registry being targeted, the client application always requested a token with the same audience, making the token replayable across different registry instances.

GitHubOIDCHandler.ExchangeToken

internal/api/handlers/v0/auth/github_oidc.go

This server-side function was responsible for validating the received GitHub OIDC token. It used a hardcoded audience ('mcp-registry') for validation. This allowed an attacker who captured a token intended for one registry to replay it to another registry, which would incorrectly validate it, leading to an authentication bypass.

GitHubOIDCProvider.GetToken

cmd/publisher/auth/github-oidc.go

This function orchestrates the client-side OIDC authentication flow. It was vulnerable because it called `getOIDCTokenFromGitHub` without providing a specific audience, which resulted in the use of a hardcoded, global audience. This initiated the process of obtaining a replayable token.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.