# Microsoft MCP Gateway: a CVSS 8.8 CVE for the name collision flaw

> CVE-2026-109492 is an authorization bypass in Microsoft MCP Gateway that lets one authenticated user reach another user's workloads.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** Microsoft
- **Disclosed:** 2026-11-10
- **CVE:** CVE-2026-109492
- **CVSS:** 8.8
- **Affects:** Microsoft MCP Gateway
- **Research by:** Microsoft MCP Gateway maintainers
- **Primary source:** https://github.com/advisories/GHSA-xgj3-w2cc-qgrq
- **Page:** https://theinjection.dev/items/microsoft-mcp-gateway-name-collision-cve/

Microsoft assigned CVE-2026-109492, which it rates CVSS 8.8, to an authorization bypass in its open-source MCP Gateway. NVD lists versions before 1.0.0 as affected, the release that fixed the gateway's name collision flaw.

## What happened

Microsoft issued CVE-2026-109492 on November 10, 2026 for MCP Gateway, its open-source reverse proxy that deploys and routes MCP servers on Kubernetes. Microsoft's own record describes an authorization bypass through a user-controlled key and says an authenticated attacker can send crafted network requests to reach another user's resources. No finder is named in the advisory.

## How it works

The gateway runs each adapter and tool as a Kubernetes StatefulSet and Service named after the resource, inside one shared namespace. According to the project's October advisory, creating a resource under a name another object already used still succeeded and made the caller its owner, so later operations acted on the existing object. An adapter named toolgateway could therefore replace the built-in gateway's container image while keeping its service account and secret environment variables, including the shared secret.

## Who is affected

Builds of microsoft/mcp-gateway from main before commit f57c4f0, and latest images published before 2026-10-14, are affected. Exploitation needs an account that is already allowed to create adapters or tools through the management API, which makes multi-tenant deployments the exposed case. Microsoft's record marks the flaw as not exploited.

## What to do

Update to MCP Gateway 1.0.0 or later, which reserves the toolgateway name, requires names to be unique across adapters and tools, and fails creation when the Kubernetes object already exists. Until the update lands, the project advises limiting management API access to trusted users.

## Quick facts

- **CVE:** CVE-2026-109492
- **CVSS:** 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), scored by Microsoft
- **Weakness:** CWE-639, authorization bypass through a user-controlled key
- **Affected:** Versions before 1.0.0, per NVD
- **Fixed in:** 1.0.0, commit f57c4f0, 2026-10-14
- **Impact:** Read another user's pod logs, delete their workloads, take over the built-in tool gateway

## Sources

1. [GitHub Advisory](https://github.com/advisories/GHSA-xgj3-w2cc-qgrq)
2. [Project Advisory](https://github.com/microsoft/mcp-gateway/security/advisories/GHSA-frpg-5vp2-p974)
3. [MCP Gateway Repo](https://github.com/microsoft/mcp-gateway)