--- id: "CVE-2026-100307" page: "https://infrastack.ai/live/CVE-2026-100307" kind: "vulnerability" aliases: ["CVE-2026-100307"] title: "Amazon mcp-gateway-registry: authenticated users can escalate to registry administrator" severity: "high" cvss: 8.8 epss: null exploited: false status: "open" category: "ai-tooling" products: [] ecosystems: [] tags: ["ai-agents", "ai-tooling", "aws", "lab-disclosure", "mcp", "self-hosted"] not_affected_if: ["no-authenticated-low-privilege-users", "version-1.25.0-or-later"] published_at: "2026-11-11T00:00:00+00:00" first_seen_at: "2026-11-11T21:28:41+00:00" updated_at: "2026-11-11T21:30:36+00:00" sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/2026-179-aws/", "first_seen_at": "2026-11-11T21:28:41+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100307", "first_seen_at": "2026-11-11T21:29:07+00:00"}] exploit_sources: [] --- # Amazon mcp-gateway-registry: authenticated users can escalate to registry administrator Link for people: https://infrastack.ai/live/CVE-2026-100307 (this .md is for agents) Amazon mcp-gateway-registry, a registry and gateway for Model Context Protocol servers, did not check roles on its management API endpoints. An authenticated low-privileged user could map their own identity-provider group to the administrator scope through POST /api/servers/groups/import and then control every registered gateway asset. _Summary, check and fix written by a model from the sources; labelled as such._ ## How to check - Check the installed mcp-gateway-registry version; affected versions are `1.0.9` through `1.24.7`. - Inspect the mcp_scopes DocumentDB collection for group_mappings entries pointing to mcp-registry-admin or ui_permissions granting mutating actions to all. - Search application HTTP logs for POST /api/servers/groups/import requests from non-administrator accounts. ## Fix - Upgrade mcp-gateway-registry to `1.25.0`. - After upgrading, review the mcp_scopes collection: the upgrade does not modify existing group definitions or invalidate previously read credentials. ## Timeline - 2026-11-11T21:28:41+00:00 lab https://aws.amazon.com/security/security-bulletins/2026-179-aws/ — AWS: CVE-2026-100307 - Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator - 2026-11-11T21:29:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-100307 ## Documents - [advisory] AWS: CVE-2026-100307 - Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator https://aws.amazon.com/security/security-bulletins/2026-179-aws/ - [advisory] Vendor advisory: github.com https://github.com/agentic-community/mcp-gateway-registry/security/advisories/GHSA-rxf3-qgpv-wxvr - [advisory] AWS Security Bulletins: CVE-2026-100307 - Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator https://aws.amazon.com/security/security-bulletins/rss/2026-179-aws/ - [fix] Release notes: github.com https://github.com/agentic-community/mcp-gateway-registry/releases/tag/1.25.0 ## From the sources CVE-2026-100307 - Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator ### CVE-2026-100307 - Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator Bulletin ID: 2026-179-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/11/2026 12:30 PM PST Description: Amazon mcp-gateway-registry is an open-source registry and gateway for Model Context Protocol (MCP) servers that centralizes discovery, access control, and proxying of registered MCP tool assets. We identified CVE-2026-100307, a missing-authorization issue in the external management API. The /api/servers/* management endpoints authenticated the caller but did not perform role-based or permission-based authorization. As a result, an authenticated low-privileged remote user could submit a crafted group import request to POST /api/servers/groups/import that mapped their own identity-provider group to the registry administrator scope. Because administrator status is derived per request, the escalation took effect on the caller's next request with no re-authentication, granting administrative control over every registered gateway asset. Impacted versions: >= 1.0.9 AND <= 1.24.7 Resolution: This issue has been addressed in mcp-gateway-registry version 1.25.0 (released 2026-06-27). We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Post-upgrade actions: Version 1.25.0 enforces authorization on the write path. It does not modify group definitions that were written before the upgrade, and it does not invalidate credentials that were read before the upgrade. A privileged group mapping created through the affected endpoints continues to confer administrator access after the upgrade. Customers who ran an affected version (>= 1.0.9, <= 1.24.7) should complete the following steps after upgrading, using the period during which an affected version was deployed as the review period. 1. Review the scope store. In the mcp_scopes DocumentDB collection, inspect each group_mappings entry for a mapping to mcp-registry-admin or another privileged scope, and each ui_permissions entry that grants a mutating action to all. Remove any grant that was not created by an administrator. This step removes administrator access that otherwise persists after the upgrade. 2. Review application HTTP logs. For the review period, search for POST /api/servers/groups/import requests from non-administrator accounts, and for requests to the sibling routes /api/servers/groups/create, /api/servers/groups/add, /api/servers/groups/remove, and /api/servers/groups/delete, and to the affected server-mutation routes. Correlate any result with subsequent /api/servers/* requests from the same identity to determine which resources were modified. 3. Rotate registry-managed credentials where unintended access cannot be excluded. An administrator can read the credentials the registry stores for registered servers, including the stored authentication credential and custom headers, which are decrypted on read through administrator-reachable routes, and the registry's access-control configuration. If the log records in step 2 are unavailable or incomplete, rotate these credentials at their source systems. 4. Review registered assets for unintended modification. Inspect servers and agents that were registered, modified, toggled, or removed during the review period, including any upstream URL that was changed to a different host. Workarounds: The following measures are interim mitigations for deployments that cannot yet upgrade. They limit further unintended access but do not replace the post-upgrade actions above. Until the upgrade is applied, restrict access to the external management API: - At the ingress/proxy layer, limit POST /api/servers/groups/* (and the other /api/servers/* mutation routes) to trusted administrator identities only, or block them for non-admin callers. - Monitor the scope storage (the mcp_scopes DocumentDB collection) for unexpected changes to group_mappings and ui_permissions, particularly any grant of a mutating action to all or any mapping to mcp-registry-admin. - Review application HTTP logs for POST /api/servers/groups/import requests from non-administrator accounts. References: - CVE-2026-100307 - GHSA-rxf3-qgpv-wxvr Acknowledgement: We would like to thank the external researcher (handle novice-22) for collaborating on this issue through the coordinated disclosure process. Please email aws-security@amazon.com with any s ecurity questions or concerns. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_