CVE-2026-100307: Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator
Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafted group import request.
To remediate this issue, users should upgrade to version 1.25.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon mcp-gateway-registryto a version that resolves this vulnerability.Fixed in 1.25.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Amazon mcp-gateway-registry versions 1.0.9 through 1.24.7 are affected where the external management API is available to authenticated remote users.
What does an attacker need to exploit this issue?
An attacker needs an authenticated remote identity and the ability to submit a crafted group import request to the external management API. No user interaction is required.
What access can an attacker gain?
The attacker can assign the registry administrator scope to their own identity group, escalating to administrative control over every registered gateway asset.
How should this be remediated?
Upgrade Amazon mcp-gateway-registry to version 1.25.0.