An authenticated SQL injection vulnerability exists in the metrics-service retention policy management component of Amazon MCP Gateway & Registry. The flaw arises from improper neutralization of special elements in a crafted table_name parameter that is interpolated directly into SQL statements, allowing an authenticated remote user to construct arbitrary SQL queries. This can lead to unauthorized data access, modification, or deletion, compromising confidentiality, integrity, and availability of the system.

Affected products include Amazon MCP Gateway & Registry on AWS, with versions prior to 1.0.13 susceptible to the issue. The specific vulnerable component is the retention policy subsystem within the metrics-service. No other versions are noted as impacted.

The CVSS score of 8.6 reflects high severity, and the EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA KEV, suggesting it has not yet been widely exploited. The attack vector is inferred to be authenticated remote, as the flaw requires valid user credentials to manipulate the table_name parameter. Exploitation would require the attacker to submit a specially crafted request to the service, making it a moderate effort but with potentially significant consequences.