The MCP Registry provides clients with a list of MCP servers and validates ownership of OCI images by checking label matches. In versions before 1.7.9, when the upstream OCI registry rate-limits anonymous fetches with HTTP 429, the validation function ValidateOCI incorrectly returns success without performing the critical label-match check. This 'fail open' behavior allows authenticated publishers to bind io.github.<user>/* namespaces to OCI images they do not own. Other registry types enforce stricter error handling by treating non-200 responses as hard errors. This flaw is addressed in MCP Registry version 1.7.9.

The vulnerability allows authenticated publishers to bypass ownership validation for OCI images under certain rate-limiting conditions, potentially enabling unauthorized namespace bindings. The impact is limited to integrity (low impact) with no confidentiality or availability effects reported. Exploitation requires authentication and user interaction (UI:R). No known exploits are reported in the wild.

This vulnerability is fixed in modelcontextprotocol registry version 1.7.9. Users should upgrade to version 1.7.9 or later to ensure proper ownership validation and prevent unauthorized namespace bindings. Since no official patch link or advisory is provided, verify upgrade availability from the vendor. Patch status is not yet confirmed via vendor advisory; check the vendor's official resources for current remediation guidance.