---
title: MCP gateway registry bug let any logged-in user make themselves admin over every registered MCP server and read its stored credentials; update to 1.25.0 | ctxsec
url: https://ctxsec.com/items/aws-mcp-gateway-registry-cve-2026-100307-group-import-self-grant-registry-admin-1-25-0
description: "The open-source mcp-gateway-registry (agentic-community, published in AWS's bulletin) centralizes discovery, access control and proxying for MCP servers and agents. In versions 1.0.9 through 1.24.7 the /api/servers/* management endpoints checked that a caller was logged in but not what they were allowed to do. A low-privileged user could POST a crafted group import that mapped their identity-provider group to the mcp-registry-admin scope and become administrator on their next request, gaining control of every registered server and agent and the backend credentials the registry stores. CVE-2026-100307 is rated High (CVSS 4.0 8.7) and fixed in 1.25.0."
status: "official (AWS Security Bulletin 2026-179-AWS and GHSA-rxf3-qgpv-wxvr, Nov 11, 2026)"
published: 2026-11-11
---

> The open-source mcp-gateway-registry (agentic-community, published in AWS's bulletin) centralizes discovery, access control and proxying for MCP servers and agents. In versions 1.0.9 through 1.24.7 the /api/servers/* management endpoints checked that a caller was logged in but not what they were allowed to do. A low-privileged user could POST a crafted group import that mapped their identity-provider group to the mcp-registry-admin scope and become administrator on their next request, gaining control of every registered server and agent and the backend credentials the registry stores. CVE-2026-100307 is rated High (CVSS 4.0 8.7) and fixed in 1.25.0.

[← Context & Harness Attacks](/context) · [markdown](/items/aws-mcp-gateway-registry-cve-2026-100307-group-import-self-grant-registry-admin-1-25-0.md)

official (AWS Security Bulletin 2026-179-AWS and GHSA-rxf3-qgpv-wxvr, Nov 11, 2026)

2026-11-11 7:41 PM ET

### MCP gateway registry bug let any logged-in user make themselves admin over every registered MCP server and read its stored credentials; update to 1.25.0

- **Upgrading isn't enough:** 1.25.0 doesn't undo group mappings written before the upgrade or invalidate credentials already read. Review the `mcp_scopes` collection's group mappings for unexpected admin scopes for the whole period you ran an affected version, and rotate backend credentials the registry managed.
- **Also gated by the fix:** sibling group routes (create, add, remove, delete) and server register, toggle, auth-credential update and version routes.
- **Patch forks** and derivative deployments too.
- **Lesson:** an MCP gateway is a credential vault and a control plane for every agent behind it; give its admin API the same authorization tests as any IAM system.

Sources: [AWS Security Bulletin 2026-179-AWS: CVE-2026-100307, mcp-gateway-registry](https://aws.amazon.com/security/security-bulletins/2026-179-aws/) · [GitHub advisory GHSA-rxf3-qgpv-wxvr (agentic-community/mcp-gateway-registry)](https://github.com/agentic-community/mcp-gateway-registry/security/advisories/GHSA-rxf3-qgpv-wxvr)