CVE-2026-109492

An MCP Gateway user could read or disrupt another user's workloads

Microsoft · MCP Gateway

First documented disclosure · Review checkpoint

Summary

The gateway used a caller-controlled identifier without checking resource ownership. Workload logs could be read or other users’ workloads disrupted.

Severity and exploitation evidence

High · 8.8/10 · CVSS 3.1. Severity source.

Exploitation not established: Microsoft marked exploitation as No at publication.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The gateway used a caller-controlled identifier without checking resource ownership.

Conditions required

An authenticated gateway user could reach another workload through its network interface.

Potential impact

Workload logs could be read or other users’ workloads disrupted.

Affected versions and configurations

Microsoft identifies the gateway. The CNA range does not establish a usable lower bound.

Fix and mitigation status

1.0.0 gateway image, per MSRC.

Practical next steps

Deploy the corrected Microsoft MCP Gateway image and verify workload isolation across accounts.

Operating lesson

Track the deployed SDK, extension or managed service when applying Microsoft’s remediation.

Evidence and limits

The CVE record was published on 2026-11-10.

Sources