CVE-2026-14471 - Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry

unknownCVE-2026-14471

Bulletin ID: 2026-052-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/06/2026 13:45 PM PDT Description: Amazon mcp-gateway-registry is an open-source gateway and registry for Model Context Protocol (MCP) servers, providing centralized discovery, authentication/authorization, and proxying of MCP tools for AI agents. We identified CVE-2026-14471, an issue in the metrics-service retention policy management component where a caller-supplied table_name value is interpolated into SQL statements in identifier position without proper neutralization. An authenticated remote user is able to supply a crafted table_name value to execute arbitrary SQL queries against the metrics database. This allows the user to read stored data (including API key material) and to delete or alter stored data. Impacted versions: >=1.0.3 AND <=1.0.12 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CSIRTS triage

vendor: Amazon product: mcp-gateway-registry SQL injectionaffected: >=1.0.3 AND <=1.0.12

What: An authenticated SQL injection vulnerability allows a user to execute arbitrary SQL queries.
Who is affected: Authenticated users of the mcp-gateway-registry within the specified version range.
Urgency: Remediation is critical due to the potential for data manipulation and exposure of sensitive information.
Action: Upgrade to a version outside the affected range.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch mcp-gateway-registry

Get an email when a new mcp-gateway-registry advisory drops — max one per day, one-click unsubscribe.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-07-06
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-052-aws/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-144710.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-14471	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

highCVE-2026-14471: Improper Neutralization of Special Elements in the metrics-service retention policy management…nvd

Recent advisories for - Authenticated SQL

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-4661: The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerab…nvd · 2026-07-11
mediumCVE-2025-5017: The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQ…nvd · 2026-07-11
highCVE-2026-15335: The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Fo…nvd · 2026-07-11
mediumCVE-2026-15073: The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to …nvd · 2026-07-11
mediumCVE-2026-15072: The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to …nvd · 2026-07-11
mediumCVE-2026-13262: The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPre…nvd · 2026-07-11