Amazon mcp-gateway-registry: Missing authorization in management API (CVE-2026-100307)
An authenticated remote attacker can exploit a missing authorization flaw in the Amazon mcp-gateway-registry external management API to escalate privileges and obtain administrative control over all registered gateway assets.
CVE search metadata
CVE search record: CVE-2026-100307. Severity: high. CVSS: 8.8. KEV: no. Product: mcp-gateway-registry (1.0.9-1.24.7). Brief: Amazon mcp-gateway-registry: Missing authorization in management API (CVE-2026-100307). Brief link: https://feed.craftedsignal.io/briefs/2026-11-amazon-mcp-gateway-registry-auth-bypass-cve-2026-100307/
Triage facts
Revision 1- Applicability
- mcp-gateway-registry (1.0.9-1.24.7)
- Evidence
- Unknown
- Severity
- High
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 22:12 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Amazon mcp-gateway-registry versions 1.0.9 through 1.24.7 contain a missing authorization vulnerability (CVE-2026-100307) in the external management API. An authenticated remote attacker can exploit this flaw by sending a crafted group import request to assign the registry administrator scope to their own identity group. This allows the attacker to obtain administrative control of all registered gateway assets.
Impact
Successful exploitation results in full administrative control over all registered gateway assets managed by the vulnerable service. The vulnerability is rated with a CVSS v3.1 base score of 8.8.
Recommendation
Upgrade the Amazon mcp-gateway-registry service to version 1.25.0 or later immediately to resolve the missing authorization flaw.
Immediate actions
Upgrade Amazon mcp-gateway-registry to version 1.25.0 or later
Threat Hunt
Identify authenticated users submitting group import requests to the external management API
Data: Cloud management API logs, Application access logs
Mitigations
Patch Amazon mcp-gateway-registry to 1.25.0
CVE-2026-100307