Amazon mcp-gateway-registry <1.25 Auth bypass in external mgmt API
CVE-2026-100307 Published on November 11, 2026
Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator
Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafted group import request.
To remediate this issue, users should upgrade to version 1.25.0.
Vulnerability Analysis
CVE-2026-100307 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Types
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-100307 has been classified to as an AuthZ vulnerability or weakness.
Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
Products Associated with CVE-2026-100307
stack.watch emails you whenever new vulnerabilities are published in Aws Mcp Gateway Registry or Amazon Aws. Just hit a watch button to start following.
