{"id":"GHSA-rxf3-qgpv-wxvr","kind":"vulnerability","aliases":["GHSA-rxf3-qgpv-wxvr"],"related":[],"title":"CVE-2026-100307 - Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator","description":"CVE-2026-100307 - Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator\n\n### CVE-2026-100307 - Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator\n\nBulletin ID: 2026-179-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/11/2026 12:30 PM PST\n\n Description:\n\nAmazon mcp-gateway-registry is an open-source registry and gateway for Model Context Protocol (MCP) servers that centralizes discovery, access control, and proxying of registered MCP tool assets. We identified CVE-2026-100307, a missing-authorization issue in the external management API.\n\nThe /api/servers/* management endpoints authenticated the caller but did not perform role-based or permission-based authorization. As a result, an authenticated low-privileged remote user could submit a crafted group import request to POST /api/servers/groups/import that mapped their own identity-provider group to the registry administrator scope. Because administrator status is derived per request, the escalation took effect on the caller's next request with no re-authentication, granting administrative control over every registered gateway asset.\n\nImpacted versions: >= 1.0.9 AND <= 1.24.7\n\nResolution:\n\nThis issue has been addressed in mcp-gateway-registry version 1.25.0 (released 2026-06-27). We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nPost-upgrade actions:\n\nVersion 1.25.0 enforces authorization on the write path. It does not modify group definitions that were written before the upgrade, and it does not invalidate credentials that were read before the upgrade. A privileged group mapping created through the affected endpoints continues to confer administrator access after the upgrade. Customers who ran an affected version (>= 1.0.9, <= 1.24.7) should complete the following steps after upgrading, using the period during which an affected version was deployed as the review period.\n\n1. Review the scope store. In the mcp_scopes DocumentDB collection, inspect each group_mappings entry for a mapping to mcp-registry-admin or another privileged scope, and each ui_permissions entry that grants a mutating action to all. Remove any grant that was not created by an administrator. This step removes administrator access that otherwise persists after the upgrade.\n2. Review application HTTP logs. For the review period, search for POST /api/servers/groups/import requests from non-administrator accounts, and for requests to the sibling routes /api/servers/groups/create, /api/servers/groups/add, /api/servers/groups/remove, and /api/servers/groups/delete, and to the affected server-mutation routes. Correlate any result with subsequent /api/servers/* requests from the same identity to determine which resources were modified.\n3. Rotate registry-managed credentials where unintended access cannot be excluded. An administrator can read the credentials the registry stores for registered servers, including the stored authentication credential and custom headers, which are decrypted on read through administrator-reachable routes, and the registry's access-control configuration. If the log records in step 2 are unavailable or incomplete, rotate these credentials at their source systems.\n4. Review registered assets for unintended modification. Inspect servers and agents that were registered, modified, toggled, or removed during the review period, including any upstream URL that was changed to a different host.\n\nWorkarounds:\n\nThe following measures are interim mitigations for deployments that cannot yet upgrade. They limit further unintended access but do not replace the post-upgrade actions above. Until the upgrade is applied, restrict access to the external management API:\n\n- At the ingress/proxy layer, limit POST /api/servers/groups/* (and the other /api/servers/* mutation routes) to trusted administrator identities only, or block them for non-admin callers.\n- Monitor the scope storage (the mcp_scopes DocumentDB collection) for unexpected changes to group_mappings and ui_permissions, particularly any grant of a mutating action to all or any mapping to mcp-registry-admin.\n- Review application HTTP logs for POST /api/servers/groups/import requests from non-administrator accounts.\n\nReferences:\n\n- CVE-2026-100307\n- GHSA-rxf3-qgpv-wxvr\n\nAcknowledgement:\n\nWe would like to thank the external researcher (handle novice-22) for collaborating on this issue through the coordinated disclosure process.\n\n Please email aws-security@amazon.com with any s ecurity questions or concerns.","summary":"The mcp-gateway-registry management API checks who is logged in but not what they are allowed to do, so an authenticated low-privilege user can call the group import endpoint and map their own identity-provider group to the registry administrator scope. The new admin rights apply on the next request without re-login, giving control over every registered MCP gateway asset.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","aws","lab-disclosure","mcp","mcp-gateway-registry","self-hosted"],"not_affected_if":["no-authenticated-low-privilege-users","version-1.25.0-or-later"],"how_to_check":"- Check the mcp-gateway-registry version in use; versions `>= 1.0.9` and `<= 1.24.7` are affected.\n- Review application HTTP logs for `POST /api/servers/groups/import` requests from non-administrator accounts.\n- Inspect the `group_mappings` and `ui_permissions` entries in the `mcp_scopes` DocumentDB collection for mappings to `mcp-registry-admin` or grants of a mutating action to all.","fix":"- mcp-gateway-registry: upgrade to `1.25.0`. Upgrading does not remove privileged group mappings created while an affected version ran, so those must be reviewed separately.","status":"open","published_at":"2026-11-11T00:00:00+00:00","first_seen_at":"2026-11-11T21:28:41+00:00","triaged_at":"2026-11-11T21:31:01+00:00","updated_at":"2026-11-11T21:31:01+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-11T21:31:01Z","model":"claude-haiku-5-5","output":{"fix":"- mcp-gateway-registry: upgrade to `1.25.0`. Upgrading does not remove privileged group mappings created while an affected version ran, so those must be reviewed separately.","reach":"network","title":"mcp-gateway-registry: low-privilege users can grant themselves registry admin rights","impact":"high","summary":"The mcp-gateway-registry management API checks who is logged in but not what they are allowed to do, so an authenticated low-privilege user can call the group import endpoint and map their own identity-provider group to the registry administrator scope. The new admin rights apply on the next request without re-login, giving control over every registered MCP gateway asset.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["mcp-gateway-registry","self-hosted","mcp","aws"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker gains registry admin and can read stored server credentials","analyst_note":"","how_to_check":"- Check the mcp-gateway-registry version in use; versions `>= 1.0.9` and `<= 1.24.7` are affected.\n- Review application HTTP logs for `POST /api/servers/groups/import` requests from non-administrator accounts.\n- Inspect the `group_mappings` and `ui_permissions` entries in the `mcp_scopes` DocumentDB collection for mappings to `mcp-registry-admin` or grants of a mutating action to all.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-1.25.0-or-later","no-authenticated-low-privilege-users"],"who_is_affected":"Teams that run mcp-gateway-registry at versions `1.0.9` through `1.24.7` where authenticated users can reach the external management API. The sources say the flaw lets a low-privilege authenticated user escalate, so exposure depends on who holds an account. Deployments on `1.25.0` or later are not affected by the write-path flaw, but a privileged mapping created earlier still grants admin access and must be reviewed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000978,"input_tokens":6058,"output_tokens":745,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-06':324C '-100307':3A,116C,137C,211C '-179':159C '-2026':2A,115C,136C,210C '-27':325C '/api/servers':223C,534C '/api/servers/groups':693C '/api/servers/groups/add':517C '/api/servers/groups/create':516C '/api/servers/groups/delete':520C '/api/servers/groups/import':260C,502C '/api/servers/groups/remove':518C '1':429C '1.0.9':306C,406C '1.24.7':308C,407C '1.25.0':321C,352C '11/11/2026':170C '12':171C '2':490C,602C '2026':158C,323C '3':546C '30':172C '4':614C 'access':198C,396C,483C,554C,593C,664C,681C 'access-control':592C 'account':508C 'action':350C,466C,673C 'address':314C 'admin':95B,452C 'administr':21A,91B,134C,155C,272C,275C,297C,395C,478C,482C,507C,559C,585C 'administrator-reach':584C 'affect':390C,404C,421C,524C 'agent':624C 'ai':33B 'ai-tool':32B 'allow':64B 'amazon':176C 'anoth':454C 'api':10A,53B,123C,144C,221C,686C 'appli':97B,679C 'applic':492C 'asset':113B,206C,303C,617C 'attent':167C 'authent':69B,226C,245C,295C,573C 'author':5A,118C,139C,215C,240C,354C 'aw':35B,160C,162C 'base':235C,239C 'bulletin':156C 'call':75B 'caller':228C,287C 'cannot':555C,657C 'central':196C 'chang':642C 'check':54B 'code':339C 'collect':439C 'complet':409C 'confer':394C 'configur':595C 'content':163C 'context':191C 'continu':392C 'control':107B,199C,298C,594C 'correl':529C 'could':251C 'craft':254C 'creat':387C,475C 'credenti':376C,551C,563C,574C,609C 'custom':400C,576C 'cve':1A,114C,135C,209C 'date':169C 'decrypt':580C 'definit':364C 'deploy':424C,655C 'deriv':278C,338C 'descript':175C 'determin':541C 'differ':645C 'disclosur':38B 'discoveri':197C 'documentdb':438C 'effect':284C 'enabl':16A,129C,150C 'endpoint':79B,225C,391C 'enforc':353C 'ensur':334C 'entri':444C,461C 'escal':18A,131C,152C,282C 'everi':109B,300C 'exclud':557C 'extern':8A,121C,142C,219C,684C 'fix':346C 'follow':411C,649C 'fork':336C 'gateway':14A,42B,50B,112B,127C,148C,179C,188C,302C,318C 'ghsa':23A,28A 'ghsa-rxf3-qgpv-wxvr':22A,27A 'give':106B 'grant':296C,463C,471C 'group':77B,87B,255C,268C,363C,385C,442C 'header':577C 'host':46B,646C 'http':493C 'id':157C 'ident':85B,266C,539C 'identifi':208C 'identity-provid':84B,265C 'impact':304C 'import':78B,165C,256C 'includ':570C,636C 'incomplet':606C 'incorpor':343C 'ingress/proxy':689C 'inspect':440C,621C 'interim':652C 'invalid':375C 'issu':216C,311C 'lab':37B 'lab-disclosur':36B 'latest':331C 'layer':690C 'limit':661C,691C 'log':57B,494C,598C 'login':105B 'low':71B,247C 'low-privileg':70B,246C 'manag':9A,52B,122C,143C,220C,224C,550C,685C 'map':81B,262C,386C,443C,447C 'mcp':13A,39B,41B,49B,111B,126C,147C,178C,193C,204C,317C,436C,450C 'mcp-gateway-registri':12A,40B,48B,125C,146C,177C,316C 'mcp-registry-admin':449C 'measur':650C 'miss':4A,117C,138C,214C 'missing-author':213C 'mitig':653C 'model':190C 'modif':620C 'modifi':362C,545C,628C 'mutat':465C,527C 'new':94B,345C 'next':100B,289C 'non':506C 'non-administr':505C 'open':184C 'open-sourc':183C 'oth':696C 'otherwis':485C 'patch':341C 'path':358C 'per':279C 'perform':232C 'period':417C,428C,498C,635C 'permiss':238C,460C 'permission-bas':237C 'persist':486C 'pm':173C 'post':259C,348C,501C,671C,692C 'post-upgrad':347C,670C 'privileg':17A,72B,130C,151C,248C,384C,455C 'protocol':192C 'provid':86B,267C 'proxi':201C 'pst':174C 'public':168C 'qgpv':25A,30A 'ran':402C 're':104B,294C 're-authent':293C 're-login':103B 'reachabl':586C 'read':379C,561C,582C 'recommend':327C 'record':599C 'regist':110B,203C,301C,568C,616C,627C 'registri':15A,20A,43B,51B,90B,128C,133C,149C,154C,180C,186C,271C,319C,451C,549C,565C,590C 'registry-manag':548C 'releas':322C 'remot':249C 'remov':469C,481C,631C 'replac':668C 'request':101B,257C,280C,290C,503C,511C,535C 'requir':166C 'resolut':309C 'resourc':543C 'restrict':680C 'result':243C,531C 'review':427C,430C,491C,497C,615C,634C 'right':96B 'role':234C 'role-bas':233C 'rotat':547C,607C 'rout':515C,528C,587C 'rxf3':24A,29A 'scope':92B,161C,273C,432C,437C,456C 'search':499C 'self':45B 'self-host':44B 'server':194C,526C,569C,622C 'server-mut':525C 'sibl':514C 'sourc':185C,612C 'status':276C 'step':412C,480C,601C 'store':433C,566C,572C 'submit':252C 'subsequ':533C 'system':613C 'toggl':629C 'took':283C 'tool':34B,205C 'type':164C 'ui':459C 'unavail':604C 'unintend':553C,619C,663C 'upgrad':328C,349C,370C,382C,399C,414C,489C,659C,672C,677C 'upstream':638C 'url':639C 'use':415C 'user':73B,250C 'version':305C,320C,332C,351C,405C,422C 'without':102B 'workaround':647C 'write':357C 'written':367C 'wxvr':26A,31A 'yet':658C","nicknames":[],"mitigations":[],"who_affected":"Teams that run mcp-gateway-registry at versions `1.0.9` through `1.24.7` where authenticated users can reach the external management API. The sources say the flaw lets a low-privilege authenticated user escalate, so exposure depends on who holds an account. Deployments on `1.25.0` or later are not affected by the write-path flaw, but a privileged mapping created earlier still grants admin access and must be reviewed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","aws","high","labdisclosure","mcp","mcpgatewayregistry","selfhosted"],"campaign_type":null,"search_a":"'-100307':3A '-2026':2A 'administr':21A 'api':10A 'author':5A 'cve':1A 'enabl':16A 'escal':18A 'extern':8A 'gateway':14A 'ghsa':23A,28A 'ghsa-rxf3-qgpv-wxvr':22A,27A 'manag':9A 'mcp':13A 'mcp-gateway-registri':12A 'miss':4A 'privileg':17A 'qgpv':25A,30A 'registri':15A,20A 'rxf3':24A,29A 'wxvr':26A,31A","search_b":"'admin':95B 'administr':91B 'ai':33B 'ai-tool':32B 'allow':64B 'api':53B 'appli':97B 'asset':113B 'authent':69B 'aw':35B 'call':75B 'check':54B 'control':107B 'disclosur':38B 'endpoint':79B 'everi':109B 'gateway':42B,50B,112B 'give':106B 'group':77B,87B 'host':46B 'ident':85B 'identity-provid':84B 'import':78B 'lab':37B 'lab-disclosur':36B 'log':57B 'login':105B 'low':71B 'low-privileg':70B 'manag':52B 'map':81B 'mcp':39B,41B,49B,111B 'mcp-gateway-registri':40B,48B 'new':94B 'next':100B 'privileg':72B 'provid':86B 're':104B 're-login':103B 'regist':110B 'registri':43B,51B,90B 'request':101B 'right':96B 'scope':92B 'self':45B 'self-host':44B 'tool':34B 'user':73B 'without':102B","search_c":"'-06':324C '-100307':116C,137C,211C '-179':159C '-2026':115C,136C,210C '-27':325C '/api/servers':223C,534C '/api/servers/groups':693C '/api/servers/groups/add':517C '/api/servers/groups/create':516C '/api/servers/groups/delete':520C '/api/servers/groups/import':260C,502C '/api/servers/groups/remove':518C '1':429C '1.0.9':306C,406C '1.24.7':308C,407C '1.25.0':321C,352C '11/11/2026':170C '12':171C '2':490C,602C '2026':158C,323C '3':546C '30':172C '4':614C 'access':198C,396C,483C,554C,593C,664C,681C 'access-control':592C 'account':508C 'action':350C,466C,673C 'address':314C 'admin':452C 'administr':134C,155C,272C,275C,297C,395C,478C,482C,507C,559C,585C 'administrator-reach':584C 'affect':390C,404C,421C,524C 'agent':624C 'amazon':176C 'anoth':454C 'api':123C,144C,221C,686C 'appli':679C 'applic':492C 'asset':206C,303C,617C 'attent':167C 'authent':226C,245C,295C,573C 'author':118C,139C,215C,240C,354C 'aw':160C,162C 'base':235C,239C 'bulletin':156C 'caller':228C,287C 'cannot':555C,657C 'central':196C 'chang':642C 'code':339C 'collect':439C 'complet':409C 'confer':394C 'configur':595C 'content':163C 'context':191C 'continu':392C 'control':199C,298C,594C 'correl':529C 'could':251C 'craft':254C 'creat':387C,475C 'credenti':376C,551C,563C,574C,609C 'custom':400C,576C 'cve':114C,135C,209C 'date':169C 'decrypt':580C 'definit':364C 'deploy':424C,655C 'deriv':278C,338C 'descript':175C 'determin':541C 'differ':645C 'discoveri':197C 'documentdb':438C 'effect':284C 'enabl':129C,150C 'endpoint':225C,391C 'enforc':353C 'ensur':334C 'entri':444C,461C 'escal':131C,152C,282C 'everi':300C 'exclud':557C 'extern':121C,142C,219C,684C 'fix':346C 'follow':411C,649C 'fork':336C 'gateway':127C,148C,179C,188C,302C,318C 'grant':296C,463C,471C 'group':255C,268C,363C,385C,442C 'header':577C 'host':646C 'http':493C 'id':157C 'ident':266C,539C 'identifi':208C 'identity-provid':265C 'impact':304C 'import':165C,256C 'includ':570C,636C 'incomplet':606C 'incorpor':343C 'ingress/proxy':689C 'inspect':440C,621C 'interim':652C 'invalid':375C 'issu':216C,311C 'latest':331C 'layer':690C 'limit':661C,691C 'log':494C,598C 'low':247C 'low-privileg':246C 'manag':122C,143C,220C,224C,550C,685C 'map':262C,386C,443C,447C 'mcp':126C,147C,178C,193C,204C,317C,436C,450C 'mcp-gateway-registri':125C,146C,177C,316C 'mcp-registry-admin':449C 'measur':650C 'miss':117C,138C,214C 'missing-author':213C 'mitig':653C 'model':190C 'modif':620C 'modifi':362C,545C,628C 'mutat':465C,527C 'new':345C 'next':289C 'non':506C 'non-administr':505C 'open':184C 'open-sourc':183C 'oth':696C 'otherwis':485C 'patch':341C 'path':358C 'per':279C 'perform':232C 'period':417C,428C,498C,635C 'permiss':238C,460C 'permission-bas':237C 'persist':486C 'pm':173C 'post':259C,348C,501C,671C,692C 'post-upgrad':347C,670C 'privileg':130C,151C,248C,384C,455C 'protocol':192C 'provid':267C 'proxi':201C 'pst':174C 'public':168C 'ran':402C 're':294C 're-authent':293C 'reachabl':586C 'read':379C,561C,582C 'recommend':327C 'record':599C 'regist':203C,301C,568C,616C,627C 'registri':128C,133C,149C,154C,180C,186C,271C,319C,451C,549C,565C,590C 'registry-manag':548C 'releas':322C 'remot':249C 'remov':469C,481C,631C 'replac':668C 'request':257C,280C,290C,503C,511C,535C 'requir':166C 'resolut':309C 'resourc':543C 'restrict':680C 'result':243C,531C 'review':427C,430C,491C,497C,615C,634C 'role':234C 'role-bas':233C 'rotat':547C,607C 'rout':515C,528C,587C 'scope':161C,273C,432C,437C,456C 'search':499C 'server':194C,526C,569C,622C 'server-mut':525C 'sibl':514C 'sourc':185C,612C 'status':276C 'step':412C,480C,601C 'store':433C,566C,572C 'submit':252C 'subsequ':533C 'system':613C 'toggl':629C 'took':283C 'tool':205C 'type':164C 'ui':459C 'unavail':604C 'unintend':553C,619C,663C 'upgrad':328C,349C,370C,382C,399C,414C,489C,659C,672C,677C 'upstream':638C 'url':639C 'use':415C 'user':250C 'version':305C,320C,332C,351C,405C,422C 'workaround':647C 'write':357C 'written':367C 'yet':658C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/2026-179-aws/#GHSA-rxf3-qgpv-wxvr","url":"https://aws.amazon.com/security/security-bulletins/2026-179-aws/","severity":null,"published_at":"2026-11-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-11T21:28:41+00:00","fetched_at":"2026-11-11T21:28:41+00:00","note":"AWS: CVE-2026-100307 - Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator"}],"documents":[{"id":128950,"url":"https://aws.amazon.com/security/security-bulletins/2026-179-aws/","title":"AWS: CVE-2026-100307 - Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator","kind":"advisory","source":"lab","publisher":"research","text":"CVE-2026-100307 - Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator\n\n### CVE-2026-100307 - Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator\n\nBulletin ID: 2026-179-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/11/2026 12:30 PM PST\n\n Description:\n\nAmazon mcp-gateway-registry is an open-source registry and gateway for Model Context Protocol (MCP) servers that centralizes discovery, access control, and proxying of registered MCP tool assets. We identified CVE-2026-100307, a missing-authorization issue in the external management API.\n\nThe /api/servers/* management endpoints authenticated the caller but did not perform role-based or permission-based authorization. As a result, an authenticated low-privileged remote user could submit a crafted group import request to POST /api/servers/groups/import that mapped their own identity-provider group to the registry administrator scope. Because administrator status is derived per request, the escalation took effect on the caller's next request with no re-authentication, granting administrative control over every registered gateway asset.\n\nImpacted versions: >= 1.0.9 AND <= 1.24.7\n\nResolution:\n\nThis issue has been addressed in mcp-gateway-registry version 1.25.0 (released 2026-06-27). We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nPost-upgrade actions:\n\nVersion 1.25.0 enforces authorization on the write path. It does not modify group definitions that were written before the upgrade, and it does not invalidate credentials that were read before the upgrade. A privileged group mapping created through the affected endpoints continues to confer administrator access after the upgrade. Customers who ran an affected version (>= 1.0.9, <= 1.24.7) should complete the following steps after upgrading, using the period during which an affected version was deployed as the review period.\n\n1. Review the scope store. In the mcp_scopes DocumentDB collection, inspect each group_mappings entry for a mapping to mcp-registry-admin or another privileged scope, and each ui_permissions entry that grants a mutating action to all. Remove any grant that was not created by an administrator. This step removes administrator access that otherwise persists after the upgrade.\n2. Review application HTTP logs. For the review period, search for POST /api/servers/groups/import requests from non-administrator accounts, and for requests to the sibling routes /api/servers/groups/create, /api/servers/groups/add, /api/servers/groups/remove, and /api/servers/groups/delete, and to the affected server-mutation routes. Correlate any result with subsequent /api/servers/* requests from the same identity to determine which resources were modified.\n3. Rotate registry-managed credentials where unintended access cannot be excluded. An administrator can read the credentials the registry stores for registered servers, including the stored authentication credential and custom headers, which are decrypted on read through administrator-reachable routes, and the registry's access-control configuration. If the log records in step 2 are unavailable or incomplete, rotate these credentials at their source systems.\n4. Review registered assets for unintended modification. Inspect servers and agents that were registered, modified, toggled, or removed during the review period, including any upstream URL that was changed to a different host.\n\nWorkarounds:\n\nThe following measures are interim mitigations for deployments that cannot yet upgrade. They limit further unintended access but do not replace the post-upgrade actions above. Until the upgrade is applied, restrict access to the external management API:\n\n- At the ingress/proxy layer, limit POST /api/servers/groups/* (and the other /api/servers/* mutation routes) to trusted administrator identities only, or block them for non-admin callers.\n- Monitor the scope storage (the mcp_scopes DocumentDB collection) for unexpected changes to group_mappings and ui_permissions, particularly any grant of a mutating action to all or any mapping to mcp-registry-admin.\n- Review application HTTP logs for POST /api/servers/groups/import requests from non-administrator accounts.\n\nReferences:\n\n- CVE-2026-100307\n- GHSA-rxf3-qgpv-wxvr\n\nAcknowledgement:\n\nWe would like to thank the external researcher (handle novice-22) for collaborating on this issue through the coordinated disclosure process.\n\n Please email aws-security@amazon.com with any s ecurity questions or concerns.","published_at":"2026-11-11T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}