{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mcp-gateway-registry--1.35.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:amazon:mcp_gateway_registry:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2026-125926"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mcp-gateway-registry (\u003c 1.35.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Amazon"],"content_html":"\u003cp\u003eAmazon mcp-gateway-registry before version 1.35.0 is vulnerable to server-side request forgery (SSRF). An authenticated remote attacker can manipulate the server registration and update API to send unauthorized requests to internal network services or cloud instance metadata endpoints and retrieve the resulting information.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to perform requests to internal services that may not be accessible from the public internet and to exfiltrate data from cloud instance metadata endpoints, which potentially contain sensitive configuration data or credentials.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUsers of the Amazon mcp-gateway-registry should upgrade to version 1.35.0 or later to address the vulnerability in the server registration and update API.\u003c/p\u003e\n","date_modified":"2026-11-11T22:12:21Z","date_published":"2026-11-11T22:12:21Z","id":"https://feed.craftedsignal.io/briefs/2026-11-amazon-mcp-gateway-ssrf-cve-2026-125926/","summary":"An SSRF vulnerability in the Amazon mcp-gateway-registry server registration and update API allows authenticated remote users to access internal network services and cloud metadata endpoints.","title":"Amazon mcp-gateway-registry: Server-side request forgery (CVE-2026-125926)","url":"https://feed.craftedsignal.io/briefs/2026-11-amazon-mcp-gateway-ssrf-cve-2026-125926/"}],"language":"en","title":"CraftedSignal Threat Feed - Mcp-Gateway-Registry (\u003c 1.35.0)","version":"https://jsonfeed.org/version/1.1"}