AWS mcp-gateway-registry SSRF fixed in 1.35.0 (CVE-2026-125926)
An authenticated user who can register servers could make the gateway query internal services; exploitation is not confirmed.
58
Vulnerability1 · 1 read
CVE-2026-125926
Authenticated SSRF in Amazon mcp-gateway-registry before 1.35.0
- CVSS 4.0
- 6.3 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Server-side request forgery in the server registration and update API of Amazon mcp-gateway-registry before 1.35.0 lets an authenticated remote user send crafted requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses. Deployments of that registry component are affected.
What to do: Upgrade Amazon mcp-gateway-registry to version 1.35.0.
| Product | Affected | Fixed in |
|---|---|---|
| Amazon mcp-gateway-registry | before 1.35.0 | 1.35.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request. To remediate this issue, users should upgrade to version 1.35.0.
- Weakness
- CWE-918
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X