Microsoft advisory published

Microsoft MCP Gateway kept user-created tool and adapter workloads in one Kubernetes namespace and used resource names that were insufficiently bound to the creating principal. When a tenant selected an already-used name, the Kubernetes create failed with a conflict, but the gateway could treat the name as newly owned by that tenant. Later status, log and mutation operations addressed the object by name rather than verifying its real owner.

The disclosure shows cross-tenant access to another user's gateway resources and a path involving the reserved toolgateway workload name, potentially executing a replacement image under the built-in tool identity. Reproduction depends on permission to create a tool or adapter and any image-admission restrictions. Microsoft records a source fix before the later CVE publication. No actual hostile production tenant is documented.

Affected self-hosted MCP Gateway deployments using shared Kubernetes resource namespace and pre-fix name/ownership logic; an attacker must have an authenticated creation capability.

The advisory does not prove anonymous access, every image accepted by all clusters or exploitation of already-correctly isolated namespaces. Existing colliding workloads need explicit inventory, not a blind assumption that upgrade rewrites their ownership.

Why an unsuccessful Kubernetes create was not safe. The gateway checked duplicate names only within the user's tool or adapter store. When the corresponding Kubernetes object already existed, Kubernetes returned 409 Conflict, but the gateway still created a caller-owned record. Later status, log, update, delete and routing operations looked up the existing workload by name rather than verifying that it belonged to the authenticated record.

The particularly sensitive collision was toolgateway, the built-in service with its own service account and gateway secret. The advisory describes how a replacement image could inherit that existing workload authority. Version 1.0.0, built from source commit f57c4f0, reserves the name, checks cross-type uniqueness and validates ownership before future actions. Upgrading blocks new collision paths but cannot prove that an already modified gateway image or copied secret is clean; operators must inspect and rotate those separately.