AWS mcp-gateway-registry SSRF can reach internal services (CVE-2026-125926)
Original title: AWS Warns of MCP Gateway Registry Vulnerability Allowing Attackers to Access Internal Network Services
Authenticated registrars could aim the gateway at internal addresses, including cloud metadata, until version 1.35.0.
AWS disclosed an Important server-side request forgery flaw, CVE-2026-125926, in open-source mcp-gateway-registry. Versions v1.0.3 through v1.34.0 did not validate an upstream address on the server registration and update API, so a permitted user could make the gateway request internal services and sometimes return responses. Version 1.35.0 validates those addresses. A cloud-role deployment could expose instance-metadata credentials if that path was reachable.
Unconfirmed: The item cites a broader pattern of MCP reconnaissance with metadata SSRF, not confirmed exploitation of this CVE.
- GitHub advisory scores the issue 8.5 High under CWE-918.
- A separate management API fix in 1.25.0 does not close this flaw.
- Helm installs with bundled Keycloak must adopt keycloak-client-secret before upgrading.
- Stored server entries are not cleaned by the upgrade.
- AWS credited researcher novice-22 for coordinated disclosure.
Impact: Authenticated SSRF to internal services and possible cloud credentials
| Product | Affected | Fixed in |
|---|---|---|
| AWS mcp-gateway-registry | v1.0.3 through v1.34.0 | 1.35.0 |
- 1.Upgrade to 1.35.0 and apply the Helm Keycloak secret change if used.
- 2.Review stored upstream addresses and logs for unexpected registrations or changes.
- 3.If an attached cloud role’s activity is unclear, review it and rotate credentials.
- CVEs
- CVE-2026-125926
- Vendors
- AWS
- Products
- mcp-gateway-registry
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-125926 | Authenticated SSRF in Amazon mcp-gateway-registry before 1.35.0 | 6.3 | — |
From the original article
3 min read at gbhackers.com
AWS has disclosed a server-side request forgery (SSRF) flaw in mcp-gateway-registry, an open-source registry and gateway for Model Context Protocol (MCP) servers. Tracked as CVE-2026-125926 under bulletin 2026-180-AWS, the issue lets an authenticated user make the gateway send requests to services on a deployment’s internal network. AWS rates the bulletin “Important”, and the GitHub advisory […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.