Authenticated SQL injection in the metrics-service retention policy subsystem of...

Bulletin ID:  2026-052-AWS Scope:  AWS Content Type:  Important (requires attention) Publication Date:  07/06/2026 13:45 PM PDT Description: Amazon mcp-gateway-registry is an open-source gateway and registry for Model Context Protocol (MCP) servers, providing centralized discovery, authentication/authorization, and proxying of MCP tools for AI agents. We identified CVE-2026-14471 , an issue in the metrics-service retention policy management component where a caller-supplied table_name value is interpolated into SQL statements in identifier position without proper neutralization. An authenticated remote user is able to supply a crafted table_name value to execute arbitrary SQL queries against the metrics database. This allows the user to read stored data (including API key material) and to delete or alter stored data. Impacted versions:  >=1.0.3 AND Resolution: This issue has been addressed in mcp-gateway-registry version 1.0.13 . We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Workarounds: There is no workaround. Upgrade to version 1.0.13 or later; please check the GitHub repository for the latest release . References: CVE-2026-14471 GHSA-79qc-vqfr-xx5q PR #451 Acknowledgement: We would like to thank the security research community for collaborating on this issue through the coordinated disclosure process. Please email  aws-security@amazon.com  with any security questions or concerns.   "},"metadata":{"tags":[]}},{"fields":{"patternBoolean2":"false","id":"ams#rt-rich-textc2#pattern-data"},"metadata":{"tags":[{"name":"pattern-data","description":"Default pattern data","id":"ams#rt-rich-textc2#pattern-data","namespaceId":"rt-rich-text"}]}}]},"metadata":{"auth":{},"testAttributes":{}},"context":{"page":{"pageUrl":"https://aws.amazon.com/security/security-bulletins/2026-052-aws/"},"contentType":"page","environment":{"stage":"prod","region":"us-west-2"},"sdkVersion":"2.0.27"},"refMap":{"manifest.js":"cda3e8d042","rt-rich-text.js":"5043b0a87f","rt-rich-text.rtl.css":"6a04028f86","rt-rich-text.css":"98f5a6aee4","rt-rich-text.css.js":"3d619cc2e1","rt-rich-text.rtl.css.js":"ccdb945d3e"},"settings":{"templateMappings":{"patternHeading":"patternHeading","patternSubheading":"patternSubheading","patternDark":"patternBoolean2","title":"itemHeading","bodyText":"itemLongLoc"}}} CVE-2026-14471 - Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry Bulletin ID:  2026-052-AWS Scope:  AWS Content Type:  Important (requires attention) Publication Date:  07/06/2026 13:45 PM PDT Description: Amazon mcp-gateway-registry is an open-source gateway and registry for Model Context Protocol (MCP) servers, providing centralized discovery, authentication/authorization, and proxying of MCP tools for AI agents. We identified CVE-2026-14471 , an issue in the metrics-service retention policy management component where a caller-supplied table_name value is interpolated into SQL statements in identifier position without proper neutralization. An authenticated remote user is able to supply a crafted table_name value to execute arbitrary SQL queries against the metrics database. This allows the user to read stored data (including API key material) and to delete or alter stored data. Impacted versions:  >=1.0.3 AND Resolution: This issue has been addressed in mcp-gateway-registry version 1.0.13 . We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Workarounds: There is no workaround. Upgrade to version 1.0.13 or later; please check the GitHub repository for the latest release . References: CVE-2026-14471 GHSA-79qc-vqfr-xx5q PR #451 Acknowledgement: We would like to thank the security research community for collaborating on this issue through the coordinated disclosure process. Please email&

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Severity from

NVD

• aws.amazon.com/security/security-bulletins/rss/2026-052-aws/
• www.cve.org/CVERecord?id=CVE-2026-14471