PT-2026-145448

CVE-2026-100307

Published

2026-11-11

Updated

2026-11-13

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Amazon mcp-gateway-registry versions 1.0.9 through 1.24.7

Description Missing authorization in the external management API allows an authenticated remote user to obtain administrative control of every registered gateway asset. This is achieved by sending a crafted group import request to assign the registry administrator scope to their own identity group.

Recommendations Upgrade to version 1.25.0.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

CWE-266: Incorrect Privilege Assignment

Related identifiers

CVE-2026-100307