CVE-2026-14471
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability in the metrics-service retention policy management component of Amazon mcp-gateway-registry before version 1.0.13 allows an authenticated remote user to execute arbitrary SQL queries via a crafted table_name value that is interpolated into SQL statements in identifier position.
Risk Assessment
An attacker could read, modify, or delete database data, leading to a breach of confidentiality, integrity, and availability of the system.
Recommendation
Upgrade Amazon mcp-gateway-registry to version 1.0.13 or later immediately.
Original NVD description (English source)
Improper Neutralization of Special Elements in the metrics-service retention policy management component in Amazon mcp-gateway-registry before 1.0.13 might allow an authenticated remote user to execute arbitrary SQL queries via a crafted table_name value that is interpolated into SQL statements in identifier position. To remediate this issue, users should upgrade to version 1.0.13 or later.