MCP Gateway Registry group import let a low-privilege caller acquire admin mappings

The agentic-community MCP Gateway Registry accepted an authenticated group-import request without checking the caller had authority to change group mappings. A user could map their own identity-provider group to mcp-registry-admin and obtain elevated gateway capabilities on a subsequent request.

Affected releases 1.0.9 through 1.24.7 allowed the group import to change effective permissions. Existing mappings and permissions may survive upgrading; gateway configuration and decrypted backend integration credentials can become reachable when administrator rights are obtained. An authorization test must protect updates to the mapping itself, not merely authenticate the requester. Previously exposed credentials require separate rotation after the code is repaired.

The advisory documents a vulnerability and patch at 1.25.0; it does not establish a real compromised tenant, decrypted customer secret or attacker-operated campaign. Upgrade, audit persisted permission mappings and rotate any actually exposed gateway secrets.

Evidence reconciliation and effect boundary. A successful login only identifies the caller; it does not authorize changing the mapping by which the registry later decides whether that caller is an administrator. The bad mapping persisted in the registry’s policy store and could expose registered agents, server configurations and managed credentials. The version 1.25.0 fix closes this management authorization path, but administrators should inspect and remove existing malicious mappings rather than assume an upgrade reverses prior writes.