Pending registration takeover via attacker-supplied verification key in Registry PUT

Impact

On July 23, 2026, an open-source community member reported a security vulnerability in the Pelican Registry (the federation's central service) to the Pelican team. We have confirmed a takeover risk affecting any non-approval (pending or denied) registration, including both namespace and server registrations: an authenticated non-owner can overwrite the registration's stored public key and owner ID (UserID), becomeing its persistent owner.

In Open Science Data Federation (OSDF), every functional registration requires approval, so no live registration can be hijacked directly. Escalation to the federation-wide impact requires a federation administrator to approve the attacker-poisoned pending registration. However, in a federation (we are aware of no such federation besides OSDF, though one could exist) with defaults RequireOriginApproval=false / RequireCacheApproval=false (in OSDF, they are both set to true), a registration issuer JWKS is served federation-wide whether or not it is approved. In that configuration the attacker's key immediately becomes the trusted issuer key for the affected prefix, allowing them to mint valid data and issuer tokens and impersonate the poisoned origin or cache.

Immediate Mitigation

Pelican Registry Administrators shoud review all pending registrations and remove any that appear to have been poisoned by an attacker.

Permanet Fix

An upcoming patch will prevent a registration's stored public key and UserID from being overwritten by a non-owner, and Pelican will ship with registration approval required by default (OSDF already requires it by default). Administrators running an affected version should upgrade to the patched release once it is available.