mcp-gateway-registry management API lets users grant themselves admin

high severity · published 2026-11-11

An authenticated remote user can use the external management API without proper authorization to give their own identity group the registry administrator scope. This gives them administrative control of every registered gateway asset.

Fixed in: 1.25.0

CVE: CVE-2026-100307

Source: aws.amazon.com

Am I affected?

You are affected if the installed version is older than 1.25.0. Check the version you have and update to 1.25.0 or later. The fixed version is verified against a vendor or advisory source.

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 2558 and your operating system.