AWS Patches SSRF Vulnerability in mcp-gateway-registry, Mitigating Internal Network and Credential Access Risks
AWS has addressed CVE-2026-125926, a server-side request forgery flaw in its mcp-gateway-registry, which could have allowed authenticated attackers to access internal services and potentially cloud credentials.
Amazon Web Services (AWS) has released a patch for a critical server-side request forgery (SSRF) vulnerability, identified as CVE-2026-125926, within its mcp-gateway-registry software. This flaw, affecting versions 1.0.3 through 1.34.0, could permit an authenticated attacker to manipulate the gateway's upstream address, thereby gaining access to internal services or even sensitive cloud credentials.
The vulnerability arises from how the mcp-gateway-registry handles upstream addresses during server registration or updates. An attacker possessing valid credentials and the necessary permissions to modify server configurations can craft a malicious upstream address. This crafted request forces the gateway to initiate connections to internal network resources from its own network vantage point, potentially bypassing standard access controls. In some instances, the gateway's response could also be intercepted by the attacker, revealing information from the targeted internal services.
While the vulnerability does not allow for unauthenticated access, its impact is significant for authenticated users. The primary risk lies in an attacker's ability to control the gateway's outbound connections, enabling access to systems that would otherwise be unreachable. The potential for credential theft is also a concern, particularly when the gateway operates with an attached cloud role. Such a scenario could mirror attacks that exploit Server-Side Request Forgery to access temporary cloud credentials via unprotected metadata endpoints.
AWS disclosed the vulnerability on November 11, 2026, and has urged all users to upgrade to version 1.35.0, which contains the fix. The security bulletin emphasizes that while the new version addresses CVE-2026-125926, administrators must also review existing upstream addresses after upgrading, as previously stored configurations are not automatically corrected. Any unintended destinations should be removed or rectified.
Beyond upgrading, AWS recommends that organizations examine application logs for any suspicious server registrations or unexpected address changes during the period when an affected version was in use. If the registry was associated with a cloud role and suspicious activity cannot be ruled out, reviewing and potentially rotating the role's credentials is advised. It's important to note that a separate vulnerability fixed in version 1.25.0 does not mitigate CVE-2026-125926, meaning deployments on versions 1.25.0 through 1.34.0 remain vulnerable.
For organizations unable to patch immediately, AWS suggests implementing several mitigation strategies. These include restricting registration and editing privileges to only trusted accounts, enforcing network segmentation to limit outbound connections from the registry and auth-server components, mandating the use of IMDSv2 for EC2 instances, and minimizing the permissions granted to attached cloud roles. While these measures can reduce risk, they are not a substitute for upgrading the software and auditing configurations.
The open-source mcp-gateway-registry project serves as a centralized registry and gateway for Model Context Protocol servers, providing essential functions like server discovery, access control, and tool proxying. The successful patching of this SSRF vulnerability underscores the ongoing efforts to secure cloud infrastructure and internal service communication against sophisticated exploitation techniques.