Critical SQL Injection in AWS mcp-gateway-registry Metrics Service
AWS mcp-gateway-registry versions 1.0.3 through 1.0.12 have a nasty authenticated SQL injection vulnerability (CVE-2026-14471) in the metrics-service retention policy subsystem. An authenticated attacker can craft malicious table_name values to execute arbitrary SQL queries, potentially exposing API keys and modifying database contents. Action required: upgrade to a patched version immediately if you're running affected versions.