CVE-2026-125926: Server-side request forgery in the server registration and update API in mcp-gateway-registry
Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request.
To remediate this issue, users should upgrade to version 1.35.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon mcp-gateway-registryto a version that resolves this vulnerability.Fixed in 1.35.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated remote user can exploit it. The attacker needs access that permits use of the server registration or update API and must submit a crafted request.
What systems can be reached through the vulnerable gateway?
The gateway may be induced to send requests to internal network services and cloud instance metadata endpoints. The attacker may be able to read the responses returned through the crafted request.
Are deployments running version 1.35.0 affected?
No. The issue affects mcp-gateway-registry versions before 1.35.0; upgrading to version 1.35.0 is the stated remediation.