CVE-2026-14471 - Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry

Summary

CVE-2026-14471 is an authenticated SQL injection in the metrics-service retention policy management component of Amazon mcp-gateway-registry, affecting versions >=1.0.3 and <=1.0.12. A caller-supplied table_name value is interpolated into SQL in identifier position without proper neutralization, letting an authenticated remote user run arbitrary SQL against the metrics database. This allows reading stored data, including API key material, and deleting or altering that data.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• HighCVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRFSame vendor · AWS Security Bulletins
• HighCVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker DistributionSame vendor · AWS Security Bulletins
• CriticalCVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWSSame vendor · AWS Security Bulletins
• HighCVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scanSame vendor · AWS Security Bulletins
• HighGHSA-6v3r-4p5c-mrp5: Language Servers for AWS vulnerable to arbitrary file writeSame vendor · GitHub Advisory Database