The MCP Registry accepts GitHub OIDC tokens that are bound only to a generic audience string (mcp-registry) rather than to a specific registry instance. Consequently, a token obtained while interacting with one registry deployment can be reused when accessing any other deployment that shares the same codebase and audience setting. This flaw, a manifestation of CWE‑918 (Broken Object Token Binding), allows an attacker who controls a repository to publish or modify artifacts in an unintended registry, compromising the integrity of the registry’s contents.

The vulnerability affects all versions of the MCP Registry from the modelcontextprotocol:registry product that are older than 1.7.6. No other vendors or products are listed as impacted.

The CVSS score of 2.1 implies a low severity rating, and no EPSS score is available, suggesting a low to uncertain exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to acquire a valid GitHub Actions ID token for a target repository, which typically requires user-level access or a compromised workflow. Once the token is in possession, it can be replayed against any registry instance that shares the audience string, thereby granting publish permissions that the attacker should not possess. Given the low severity and lack of public exploitation evidence, the immediate risk is moderate but warrants prompt mitigation.