Microsoft MCP Gateway: a CVSS 8.8 CVE for the name collision flaw

01What happened

Microsoft issued CVE-2026-109492 on November 10, 2026 for MCP Gateway, its open-source reverse proxy that deploys and routes MCP servers on Kubernetes. Microsoft's own record describes an authorization bypass through a user-controlled key and says an authenticated attacker can send crafted network requests to reach another user's resources. No finder is named in the advisory.

02How it works

The gateway runs each adapter and tool as a Kubernetes StatefulSet and Service named after the resource, inside one shared namespace. According to the project's October advisory, creating a resource under a name another object already used still succeeded and made the caller its owner, so later operations acted on the existing object. An adapter named toolgateway could therefore replace the built-in gateway's container image while keeping its service account and secret environment variables, including the shared secret.

03Who is affected

Builds of microsoft/mcp-gateway from main before commit f57c4f0, and latest images published before 2026-10-14, are affected. Exploitation needs an account that is already allowed to create adapters or tools through the management API, which makes multi-tenant deployments the exposed case. Microsoft's record marks the flaw as not exploited.

04What to do

Update to MCP Gateway 1.0.0 or later, which reserves the toolgateway name, requires names to be unique across adapters and tools, and fails creation when the Kubernetes object already exists. Until the update lands, the project advises limiting management API access to trusted users.

Sources 3 links, all fetched

1. 1github.comGitHub Advisory
2. 2github.comProject Advisory
3. 3github.comMCP Gateway Repo