Amazon mcp-gateway-registry: Server-side request forgery (CVE-2026-125926)
An SSRF vulnerability in the Amazon mcp-gateway-registry server registration and update API allows authenticated remote users to access internal network services and cloud metadata endpoints.
CVE search metadata
CVE search record: CVE-2026-125926. Severity: high. CVSS: 8.5. KEV: no. Product: mcp-gateway-registry (< 1.35.0). Brief: Amazon mcp-gateway-registry: Server-side request forgery (CVE-2026-125926). Brief link: https://feed.craftedsignal.io/briefs/2026-11-amazon-mcp-gateway-ssrf-cve-2026-125926/
Triage facts
Revision 1- Applicability
- mcp-gateway-registry (< 1.35.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 22:12 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Amazon mcp-gateway-registry before version 1.35.0 is vulnerable to server-side request forgery (SSRF). An authenticated remote attacker can manipulate the server registration and update API to send unauthorized requests to internal network services or cloud instance metadata endpoints and retrieve the resulting information.
Impact
Successful exploitation allows an authenticated attacker to perform requests to internal services that may not be accessible from the public internet and to exfiltrate data from cloud instance metadata endpoints, which potentially contain sensitive configuration data or credentials.
Recommendation
Users of the Amazon mcp-gateway-registry should upgrade to version 1.35.0 or later to address the vulnerability in the server registration and update API.
Immediate actions
Upgrade Amazon mcp-gateway-registry to version 1.35.0 or later
Threat Hunt
Monitor access logs for the server registration and update API endpoints for unusual patterns or external IP-formatted addresses within parameter fields
Data: Web server access logs
Mitigations
Upgrade Amazon mcp-gateway-registry to version 1.35.0
CVE-2026-125926