# CVE-2026-45781: Model Context Protocol Registry ownership bypass in OCI validator

Source: https://junglewise.ai/threats/cve-2026-45781-model-context-protocol-registry-ownership-bypass-in-oci-validator  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-45781 · Severity: low · CVSS 3.5 · Published 2026-05-14

The Model Context Protocol (MCP) Registry, which helps users discover and use AI-related server tools, contains a flaw in how it verifies ownership of container images. When the registry is busy or being intentionally flooded with requests, it may skip security checks that confirm a publisher actually owns the image they are listing. This allows an attacker to list reputable third-party software under their own name, potentially misleading users through impersonation or typo-squatting.

Technologies: [github.com/modelcontextprotocol/registry (Go)](https://junglewise.ai/threats/technologies/github-com-modelcontextprotocol-registry), [Model Context Protocol Registry](https://junglewise.ai/threats/technologies/registry). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Model Context Protocol](https://junglewise.ai/threats/vendors/model-context-protocol).

## Quick answers

**Is CVE-2026-45781 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45781 being exploited in the wild.

**How severe is CVE-2026-45781?** Low severity, with a CVSS score of 3.5, published 14 May 2026.

**Which products and versions are affected?** github.com/modelcontextprotocol/registry (Go) < 1.7.9, SEMVER:introduced=0,fixed=1.7.9; Model Context Protocol MCP Registry < 1.7.9; Model Context Protocol Registry < 1.7.9.

**Is there a fix for CVE-2026-45781?** Yes. github.com/modelcontextprotocol/registry (Go): upgrade to 1.7.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45781 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-45781?** Check whether you run github.com/modelcontextprotocol/registry (Go), Model Context Protocol MCP Registry or Model Context Protocol Registry at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/modelcontextprotocol/registry (Go): upgrade to 1.7.9 or later

  ```sh
  go get github.com/modelcontextprotocol/registry@v1.7.9
  ```


## Technical details

The vulnerability exists in `internal/validators/registries/oci.go` where the `ValidateOCI` function returns `nil` (success) when a `http.StatusTooManyRequests` (429) error is received from an upstream OCI registry like Docker Hub. This 'fail-open' behavior bypasses the mandatory `io.modelcontextprotocol.server.name` label-match check, which is the primary mechanism for proving image ownership. An attacker can intentionally trigger this state by exhausting the registry's anonymous Docker Hub quota (100 pulls/6h) through rapid `/publish` requests. Once the quota is exhausted, the attacker can successfully publish a server record that points to any public OCI image they do not control. The issue is fixed in version 1.7.9 by treating rate limits as a validation error.

## Affected products

- modelcontextprotocol registry < 1.7.9

## Identifiers

- CVE-2026-45781
- GHSA-2v5f-5r6w-p67r
- GO-2026-5008

## Timeline

- 2026-05-09: other: Vulnerability identified in commit fe0cb3b
- 2026-05-12: disclosed: Reported via GitHub Private Security Advisory
- 2026-05-19: patched: Fix released in version 1.7.9
- 2026-05-19: advisory

## References

- [https://api.github.com/users/rdimitrov](https://api.github.com/users/rdimitrov)
- [https://github.com/rdimitrov](https://github.com/rdimitrov)
- [https://api.github.com/users/rdimitrov/gists%7B/gist_id%7D](https://api.github.com/users/rdimitrov/gists%7B/gist_id%7D)
- [https://api.github.com/users/rdimitrov/repos](https://api.github.com/users/rdimitrov/repos)
- [https://avatars.githubusercontent.com/u/16540482?v=4](https://avatars.githubusercontent.com/u/16540482?v=4)
- [https://api.github.com/users/rdimitrov/events%7B/privacy%7D](https://api.github.com/users/rdimitrov/events%7B/privacy%7D)

## Related threats

- [Model Context Protocol Registry OIDC token replay via shared audience](https://junglewise.ai/threats/cve-2026-44428-model-context-protocol-registry-oidc-token-replay-via-shared)
- [Model Context Protocol Registry open redirect in TrailingSlashMiddleware](https://junglewise.ai/threats/cve-2026-44427-model-context-protocol-registry-open-redirect-in)
- [Model Context Protocol Registry SSRF via IPv6 Filter Bypass](https://junglewise.ai/threats/cve-2026-44430-model-context-protocol-registry-ssrf-via-ipv6-filter-bypass)
- [MCP Registry stored XSS in catalogue UI via websiteUrl](https://junglewise.ai/threats/cve-2026-44429-mcp-registry-stored-xss-in-catalogue-ui-via-websiteurl)