CVE-2026-44428

score

<0.1

cvss

4.7

epss

0.3%

published

2026-05-14

kev added

—

first seen

2026-10-21

MCP Registry < 1.7.6 contains a broken authentication caused by GitHub OIDC tokens bound only to a global audience string instead of specific registry instances, letting attackers use tokens across deployments, exploit requires valid GitHub Actions ID token.