CVE-2026-109492: Microsoft MCP Gateway Elevation of Privilege Vulnerability

Q: Who can exploit this vulnerability?

An attacker must already be authorized to access Microsoft MCP Gateway and must be able to reach it over the network. No user interaction is required.

Q: What level of impact could exploitation have?

Successful exploitation allows privilege elevation and is rated as having high impact on confidentiality, integrity, and availability. The vulnerability has a CVSS severity of high, with a score of 8.8.

Q: Is there a known workaround if patching cannot be performed immediately?

The provided information does not identify a workaround or mitigation. Restricting network access to Microsoft MCP Gateway and reviewing authorized users may reduce exposure, but no vendor-supported workaround is provided in the data.

Published Nov 10, 2026

Updated

Authorization bypass through user-controlled key in Microsoft MCP Gateway allows an authorized attacker to elevate privileges over a network.

Other sources

Microsoft MCP Gateway Elevation of Privilege Vulnerability

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft mcp-gateway<1.0.0

1.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.0

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·04:00 PM

Affected Software

CVE Published

via MITRE·06:15 PM

Data Sourced

via MITRE·06:15 PM

DescriptionSeverity

Data Sourced

via NVD·07:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must already be authorized to access Microsoft MCP Gateway and must be able to reach it over the network. No user interaction is required.

What level of impact could exploitation have?

Successful exploitation allows privilege elevation and is rated as having high impact on confidentiality, integrity, and availability. The vulnerability has a CVSS severity of high, with a score of 8.8.

Is there a known workaround if patching cannot be performed immediately?

The provided information does not identify a workaround or mitigation. Restricting network access to Microsoft MCP Gateway and reviewing authorized users may reduce exposure, but no vendor-supported workaround is provided in the data.

CVE-2026-109492: Microsoft MCP Gateway Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What level of impact could exploitation have?

Is there a known workaround if patching cannot be performed immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What level of impact could exploitation have?

Is there a known workaround if patching cannot be performed immediately?