What happened
The /api/servers/* management endpoints authenticated the caller but did not enforce role/permission-based authorization. A crafted group import could map the caller's identity-provider group to the registry administrator scope, granting full administrative control over every registered gateway asset — including reading stored auth credentials and custom headers that are decrypted on read through admin-reachable routes.
Why it matters
The registry is a central control point for MCP tool assets and their credentials. Escalation to admin yields read/write of every registered MCP server, modification of upstream URLs (a path to SSRF/lateral movement), and extraction of registry-managed authentication secrets — a high-value target in an MCP-based agent architecture.
Attack vector
An authenticated low-privileged user submits a crafted group import request to POST /api/servers/groups/import that maps their identity-provider group to the mcp-registry-admin scope (or grants a mutating UI permission to all). Because administrator status is derived per request, the escalation takes effect on the next request with no re-authentication.
Affected systems
Amazon mcp-gateway-registry >= 1.0.9 AND <= 1.24.7 (fixed in 1.25.0)
Mitigation
Upgrade to mcp-gateway-registry 1.25.0+, then audit the mcp_scopes DocumentDB collection for group_mappings pointing at mcp-registry-admin (or ui_permissions granting mutating actions to all) and remove unintended grants; review HTTP logs for POST /api/servers/groups/import from non-admin accounts; rotate registry-managed credentials; verify registered servers/agents/upstream URLs. Interim: restrict /api/servers/* mutation routes to trusted admin identities at the ingress.