Cpe:2.3:a:amazon:mcp_gateway_registry:*:*:*:*:*:*:*:*

An SSRF vulnerability in the Amazon mcp-gateway-registry server registration and update API allows authenticated remote users to access internal network services and cloud metadata endpoints.

An authenticated remote attacker can exploit a missing authorization flaw in the Amazon mcp-gateway-registry external management API to escalate privileges and obtain administrative control over all registered gateway assets.