Bulletin ID: 2026-052-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 07/06/2026 13:45 PM PDT

Description:

Amazon mcp-gateway-registry is an open-source gateway and registry for Model Context Protocol (MCP) servers, providing centralized discovery, authentication/authorization, and proxying of MCP tools for AI agents. We identified CVE-2026-14471, an issue in the metrics-service retention policy management component where a caller-supplied table_name value is interpolated into SQL statements in identifier position without proper neutralization. An authenticated remote user is able to supply a crafted table_name value to execute arbitrary SQL queries against the metrics database. This allows the user to read stored data (including API key material) and to delete or alter stored data.

Impacted versions: >=1.0.3 AND <=1.0.12

Resolution:

This issue has been addressed in mcp-gateway-registry version 1.0.13. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

There is no workaround. Upgrade to version 1.0.13 or later; please check the GitHub repository for the latest release.

References:

• CVE-2026-14471
• GHSA-79qc-vqfr-xx5q
• PR #451

Acknowledgement:

We would like to thank the security research community for collaborating on this issue through the coordinated disclosure process.

Please email aws-security@amazon.com with any security questions or concerns.