{"id":"CVE-2026-109492","kind":"vulnerability","aliases":["CVE-2026-109492"],"related":[],"title":"Microsoft MCP Gateway: user-controlled key lets authorized users gain higher privileges","description":"Authorization bypass through user-controlled key in Microsoft MCP Gateway allows an authorized attacker to elevate privileges over a network.","summary":"Microsoft's open-source MCP Gateway (a reverse proxy routing MCP sessions to servers on Kubernetes) has an authorization flaw: a user-controlled key lets an already-authorized account raise its privileges over the network. Teams running the gateway with more than one user should look at this; teams that don't run it can skip it. The exact exploit path, affected versions and fix are not confirmed by a Microsoft page I could read.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","mcp","mcp-gateway","microsoft"],"not_affected_if":["no-mcp-gateway-deployed"],"how_to_check":"Microsoft MCP Gateway (github.com/microsoft/mcp-gateway) has no tagged releases, so check whether your deployment was built from a commit before ea24454 (2026-05-22). That commit scopes session keys per user, and may relate to this CVE, but no source confirms it. Affected and fixed versions are unknown. The MSRC entry for CVE-2026-109492 would settle it. Also review who holds mcp.admin or other roles, since the attacker needs a valid account.","fix":"unknown: no fix version published. Rebuild from current main of microsoft/mcp-gateway; commit ea24454 may be the relevant fix but is unconfirmed for this CVE.","status":"open","published_at":"2026-11-10T19:18:17+00:00","first_seen_at":"2026-11-10T19:24:25+00:00","triaged_at":"2026-11-10T19:33:57+00:00","updated_at":"2026-11-10T19:35:49+00:00","category":"ai-tooling","confidence":0.4,"triage":{"at":"2026-11-10T19:33:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft MCP Gateway: user-controlled key lets authorized users gain higher privileges","impact":"high","summary":"Microsoft MCP Gateway has an authorization bypass caused by a user-controlled key, so an account that is already authorized can elevate its privileges over the network. The sources do not describe the exact exploit path beyond that.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["microsoft","mcp","mcp-gateway"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authorized user elevates privileges over the network","analyst_note":"Find the Microsoft advisory or NVD entry for CVE-2026-109492 to confirm affected and fixed versions and the setting involved.","how_to_check":"- Check whether you run Microsoft MCP Gateway, and at which version: unknown from the sources.\n- Review who holds accounts that can reach the gateway, since a valid account is required.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-mcp-gateway-deployed"],"who_is_affected":"Teams running Microsoft MCP Gateway where authorized users can reach the gateway over the network. The sources do not name affected versions or configurations, so the scope is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0007,"input_tokens":4503,"output_tokens":500,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory or NVD entry for CVE-2026-109492 to confirm affected and fixed versions and the setting involved.","search":"'-109492':16A,19A '-2026':15A,18A 'account':59B 'affect':92B 'ai':21B 'ai-tool':20B 'allow':117C 'alreadi':57B 'already-author':56B 'attack':120C 'author':9A,47B,58B,106C,119C 'bypass':107C 'confirm':98B 'control':6A,52B,111C 'could':104B 'cve':14A,17A 'elev':122C 'exact':89B 'exploit':90B 'fix':95B 'flaw':48B 'gain':11A 'gateway':3A,26B,34B,69B,116C 'higher':12A 'key':7A,53B,112C 'kubernet':44B 'let':8A,54B 'look':76B 'mcp':2A,23B,25B,33B,39B,115C 'mcp-gateway':24B 'microsoft':1A,27B,28B,101B,114C 'network':65B,126C 'one':73B 'open':31B 'open-sourc':30B 'page':102B 'path':91B 'privileg':13A,62B,123C 'proxi':37B 'rais':60B 'read':105B 'revers':36B 'rout':38B 'run':67B,83B 'server':42B 'session':40B 'skip':86B 'sourc':32B 'team':66B,79B 'tool':22B 'user':5A,10A,51B,74B,110C 'user-control':4A,50B,109C 'version':93B","nicknames":[],"mitigations":[],"who_affected":"Teams running Microsoft MCP Gateway where authorized users can reach the gateway over the network. The sources do not name affected versions or configurations, so the scope is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","high","mcp","mcpgateway","microsoft"],"campaign_type":null,"search_a":"'-109492':16A,19A '-2026':15A,18A 'author':9A 'control':6A 'cve':14A,17A 'gain':11A 'gateway':3A 'higher':12A 'key':7A 'let':8A 'mcp':2A 'microsoft':1A 'privileg':13A 'user':5A,10A 'user-control':4A","search_b":"'account':59B 'affect':92B 'ai':21B 'ai-tool':20B 'alreadi':57B 'already-author':56B 'author':47B,58B 'confirm':98B 'control':52B 'could':104B 'exact':89B 'exploit':90B 'fix':95B 'flaw':48B 'gateway':26B,34B,69B 'key':53B 'kubernet':44B 'let':54B 'look':76B 'mcp':23B,25B,33B,39B 'mcp-gateway':24B 'microsoft':27B,28B,101B 'network':65B 'one':73B 'open':31B 'open-sourc':30B 'page':102B 'path':91B 'privileg':62B 'proxi':37B 'rais':60B 'read':105B 'revers':36B 'rout':38B 'run':67B,83B 'server':42B 'session':40B 'skip':86B 'sourc':32B 'team':66B,79B 'tool':22B 'user':51B,74B 'user-control':50B 'version':93B","search_c":"'allow':117C 'attack':120C 'author':106C,119C 'bypass':107C 'control':111C 'elev':122C 'gateway':116C 'key':112C 'mcp':115C 'microsoft':114C 'network':126C 'privileg':123C 'user':110C 'user-control':109C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109492","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109492","severity":null,"published_at":"2026-11-10T19:18:17+00:00","modified_at":"2026-11-10T19:18:18+00:00","first_seen_at":"2026-11-10T19:24:25+00:00","fetched_at":"2026-11-10T19:24:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109492:2524","url":"https://github.com/microsoft/mcp-gateway/commit/ea24454","severity":null,"published_at":"2026-11-10T19:35:49+00:00","modified_at":"2026-11-10T19:35:49+00:00","first_seen_at":"2026-11-10T19:35:49+00:00","fetched_at":"2026-11-10T19:35:49+00:00","note":"NVD and MSRC pages returned no text; no Microsoft advisory read, so affected/fixed versions are unknown and nothing is verified. microsoft/mcp-gateway has no releases. Commit ea24454 (May 2026, MSRC-112281) scopes session-store keys by user id so a second user can't replay another's mcp-session-id. It may be this CVE's fix, but no source ties it to the CVE id. Linked as 'mentions' only.","cites":["https://github.com/microsoft/mcp-gateway/commit/ea24454","https://nvd.nist.gov/vuln/detail/CVE-2026-109492"]}],"documents":[{"id":117592,"url":"https://github.com/microsoft/mcp-gateway/commit/ea24454","title":"Fix MSRC-112281: SSRF (#79) - microsoft/mcp-gateway","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":117594,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109492","title":"NVD CVE-2026-109492","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}