Missing Authorization Vulnerability in Amazon MCP Gateway Registry

CVE-2026-100307

What is CVE-2026-100307?

The Amazon MCP Gateway Registry is susceptible to a missing authorization vulnerability that allows an authenticated remote user to potentially escalate privileges. Specifically, the flaw exists in the external management API, where an authenticated user can manipulate their own identity group to gain administrative control over all registered gateway assets. This can be executed via a specially crafted group import request. To mitigate this risk, users are strongly advised to upgrade to version 1.25.0 as soon as possible.

References