CVE-2026-100307

Amazon mcp-gateway-registry versions 1.0.9 through 1.24.7 are vulnerable to a missing authorization flaw in the external management API . This vulnerability allows an authenticated remote user to send a crafted group import request to assign the registry administrator scope to their own identity ...