CVE-2026-14471

highCVSS 8.1covered by 2 sourcesfirst seen 2026-07-06

Bulletin ID: 2026-052-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/06/2026 13:45 PM PDT Description: Amazon mcp-gateway-registry is an open-source gateway and registry for Model Context Protocol (MCP) servers, providing centralized discovery, authentication/authorization, and proxying of MCP tools for AI agents. We identified CVE-2026-14471, an issue in the metrics-service retention policy management component where a caller-supplied table_name value is interpolated into SQL statements in identifier position without proper neutralization. An authenticated remote user is able to supply a crafted table_name value to execute arbitrary SQL queries against the metrics database. This allows the user to read stored data (including API key material) and to delete or alter stored data. Impacted versions: >=1.0.3 AND <=1.0.12 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CSIRTS triage

What: An authenticated SQL injection vulnerability allows a user to execute arbitrary SQL queries.
Who is affected: Authenticated users of the mcp-gateway-registry within the specified version range.
Urgency: Remediation is critical due to the potential for data manipulation and exposure of sensitive information.
Action: Upgrade to a version outside the affected range.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-14471

Get an email if CVE-2026-14471 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.

Advisory coverage (2)

highCVE-2026-14471: Improper Neutralization of Special Elements in the metrics-service retention policy management…nvd · 2026-07-06
unknownCVE-2026-14471 - Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-…aws · 2026-07-06

External references

NVD record for CVE-2026-14471

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-14471 status](https://www.csirts.com/badge/CVE-2026-14471)](https://www.csirts.com/cve/CVE-2026-14471)