The MCP Registry failed to validate ownership of OCI images when the upstream registry returned an HTTP 429 Too Many Requests response, allowing any authenticated publisher to bind their io.github.<user>/* namespace to OCI images they do not control. This flaw bypasses the required label‑match check that normally prevents such cross‑system ownership escalation. The impact is that a malicious publisher could claim responsibility for arbitrary OCI images, potentially presenting counterfeit or malicious packages as legitimate.

The vulnerability affects the MCP Registry application provided by modelcontextprotocol, specifically all releases earlier than version 1.7.9. Users who have not upgraded to 1.7.9 or later are susceptible to this flaw.

With a CVSS score of 3.5 the flaw is classified as low severity. No EPSS score is available, and it is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated publisher account, and the attacker can exploit the flaw only when the upstream OCI registry is rate‑limited. Once exploited, the attacker can claim any OCI namespace and use it to distribute unwanted or malicious content under the guise of a legitimate publisher.