Microsoft has put a CVE on a name-collision bug in its open-source MCP Gateway. The Injection reports that CVE-2026-109492, published November 10, 2026, is “an authorization bypass in Microsoft MCP Gateway that lets one authenticated user reach another user’s workloads.” Microsoft rates it CVSS 8.8. “NVD lists versions before 1.0.0 as affected, the release that fixed the gateway’s name collision flaw.”
Quick Take
- Product: Microsoft MCP Gateway, an open-source gateway for Model Context Protocol servers and tools.
- Bug: A name-collision authorization bypass (CVE-2026-109492, CVSS 8.8). One authenticated user could reach another user’s workloads.
- Fix: Update to MCP Gateway 1.0.0 or later. That release, The Injection says, “reserves the toolgateway name, requires names to be unique across adapters and tools, and fails creation when the Kubernetes object already exists.”
- Until you can update: The project advises limiting management API access to trusted users.
What happened
MCP gateways sit in front of many tools and, in Kubernetes deployments, create or bind objects whose names have to be unique. If two users can cause a name collision, an authorization check that trusts the name rather than the owner can send one user into another user’s workload. That is a tenant-isolation failure, even though the attacker must already be authenticated.
Microsoft assigned the CVE on November 10 and pointed operators at 1.0.0. i10x has not independently reviewed the gateway source; the uniqueness and reserved-name changes described above come from The Injection’s summary of the project guidance.
What you should do
- Upgrade MCP Gateway to 1.0.0 or later.
- Until then, restrict who can call the management API.
- After upgrading, audit existing tool and adapter names for collisions or unexpected objects, and rotate any secrets that a neighboring workload could have reached if a collision was possible in your cluster.
What it means
MCP is quickly becoming a shared control plane, and a gateway with an 8.8 cross-user bypass is the kind of bug that shows up once a protocol leaves single-user laptops and enters multi-tenant clusters. The 1.0.0 uniqueness rules are the right shape of fix. Anyone running a pre-1.0.0 gateway in a shared Kubernetes environment should treat this as a patch-now item, not a backlog CVE.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This i10x report is based on The Injection’s week-46 summary of CVE-2026-109492 and the MSRC update-guide URL. i10x did not test Microsoft MCP Gateway.
