Amazon mcp-gateway-registry: authenticated users can escalate to registry administrator

1. Review the scope store. In the mcp_scopes DocumentDB collection, inspect each group_mappings entry for a mapping to mcp-registry-admin or another privileged scope, and each ui_permissions entry that grants a mutating action to all. Remove any grant that was not created by an administrator. This step removes administrator access that otherwise persists after the upgrade.
2. Review application HTTP logs. For the review period, search for POST /api/servers/groups/import requests from non-administrator accounts, and for requests to the sibling routes /api/servers/groups/create, /api/servers/groups/add, /api/servers/groups/remove, and /api/servers/groups/delete, and to the affected server-mutation routes. Correlate any result with subsequent /api/servers/* requests from the same identity to determine which resources were modified.
3. Rotate registry-managed credentials where unintended access cannot be excluded. An administrator can read the credentials the registry stores for registered servers, including the stored authentication credential and custom headers, which are decrypted on read through administrator-reachable routes, and the registry's access-control configuration. If the log records in step 2 are unavailable or incomplete, rotate these credentials at their source systems.
4. Review registered assets for unintended modification. Inspect servers and agents that were registered, modified, toggled, or removed during the review period, including any upstream URL that was changed to a different host.

Workarounds:

The following measures are interim mitigations for deployments that cannot yet upgrade. They limit further unintended access but do not replace the post-upgrade actions above. Until the upgrade is applied, restrict access to the external management API:

• At the ingress/proxy layer, limit POST /api/servers/groups/* (and the other /api/servers/* mutation routes) to trusted administrator identities only, or block them for non-admin callers.
• Monitor the scope storage (the mcp_scopes DocumentDB collection) for unexpected changes to group_mappings and ui_permissions, particularly any grant of a mutating action to all or any mapping to mcp-registry-admin.
• Review application HTTP logs for POST /api/servers/groups/import requests from non-administrator accounts.

References:

• CVE-2026-100307
• GHSA-rxf3-qgpv-wxvr

Acknowledgement:

We would like to thank the external researcher (handle novice-22) for collaborating on this issue through the coordinated disclosure process.

Please email aws-security@amazon.com with any s ecurity questions or concerns.