https://feed.craftedsignal.io/cpes/cpe2.3aamazonmcp_gateway_registry/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 22:12:21 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-amazon-mcp-gateway-ssrf-cve-2026-125926/Wed, 11 Nov 2026 22:12:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-amazon-mcp-gateway-ssrf-cve-2026-125926/An SSRF vulnerability in the Amazon mcp-gateway-registry server registration and update API allows authenticated remote users to access internal network services and cloud metadata endpoints.Amazon mcp-gateway-registry before version 1.35.0 is vulnerable to server-side request forgery (SSRF). An authenticated remote attacker can manipulate the server registration and update API to send unauthorized requests to internal network services or cloud instance metadata endpoints and retrieve the resulting information.

Impact

Successful exploitation allows an authenticated attacker to perform requests to internal services that may not be accessible from the public internet and to exfiltrate data from cloud instance metadata endpoints, which potentially contain sensitive configuration data or credentials.

Recommendation

Users of the Amazon mcp-gateway-registry should upgrade to version 1.35.0 or later to address the vulnerability in the server registration and update API.

]]>highadvisoryhttps://feed.craftedsignal.io/briefs/2026-11-amazon-mcp-gateway-registry-auth-bypass-cve-2026-100307/Wed, 11 Nov 2026 22:12:14 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-amazon-mcp-gateway-registry-auth-bypass-cve-2026-100307/An authenticated remote attacker can exploit a missing authorization flaw in the Amazon mcp-gateway-registry external management API to escalate privileges and obtain administrative control over all registered gateway assets.Amazon mcp-gateway-registry versions 1.0.9 through 1.24.7 contain a missing authorization vulnerability (CVE-2026-100307) in the external management API. An authenticated remote attacker can exploit this flaw by sending a crafted group import request to assign the registry administrator scope to their own identity group. This allows the attacker to obtain administrative control of all registered gateway assets.

Impact

Successful exploitation results in full administrative control over all registered gateway assets managed by the vulnerable service. The vulnerability is rated with a CVSS v3.1 base score of 8.8.

Recommendation

Upgrade the Amazon mcp-gateway-registry service to version 1.25.0 or later immediately to resolve the missing authorization flaw.

]]>highadvisorycveprivilege-escalationcloud