An authenticated SQL injection vulnerability exists in the metrics‑service retention policy management component of Amazon MCP Gateway & Registry. The flaw arises from improper neutralization of special elements in a crafted table_name parameter that is interpolated directly into SQL statements, allowing an authenticated remote user to construct arbitrary SQL or deletion, compromising confidentiality, integrity, and availability of data stored in the metrics‑service retention subsystem for versions prior to 1.0.13.

The vulnerable component is the metrics‑service retention policy subsystem of AWS MCP Gateway & Registry. All releases prior to version 1.0.13 are affected. No post‑1.0.13 version information is provided.

The CVSS score of 8.6 reflects high severity, and the EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA KEV, suggesting it has not yet been widely exploited. The remote, as the flaw requires valid user credentials to manipulate the table_name parameter. Exploitation would require the attacker to submit a specially crafted request to the service, making it a moderate effort but with potentially significant consequences.