Authenticated SSRF Vulnerability in AWS MCP Gateway Registry Risks Internal Network Exposure
AWS has disclosed a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-125926) in the open-source mcp-gateway-registry, used for Model Context Protocol (MCP) servers. The flaw allows authenticated users with permissions to register or modify servers to redirect gateway requests to internal network services, potentially exposing sensitive data such as cloud instance metadata and credentials. The vulnerability affects versions v1.0.3 through v1.34.0, and was fixed in version 1.35.0, which validates upstream addresses. This vulnerability is significant in cloud environments where abuse could lead to credential theft and lateral movement within the cloud account. AWS rates the security bulletin as "Important" with a high severity score of 8.5. Administrators are advised to upgrade to v1.35.0 and review existing server configurations for malicious entries, restrict registration permissions, enforce IMDSv2 on EC2, and rotate credentials if suspicious activity is detected. The flaw was responsibly disclosed by researcher novice-22.
Entenda a falha
A vulnerabilidade
CVE-2026-125926 is a server-side request forgery (SSRF, CWE-918) in mcp-gateway-registry, the open-source registry and gateway for Model Context Protocol servers. An authenticated user with permission to register or modify servers can point a server's upstream address at an internal service, making the gateway send requests there and sometimes return the responses. In cloud deployments this can reach the instance metadata service and its role credentials. Versions v1.0.3 through v1.34.0 are affected; v1.35.0 fixes it. The GitHub advisory scores it 8.5 (High) and AWS rates bulletin 2026-180-AWS as Important.
Como funciona
A user with registration rights calls the server registration or update API and supplies an upstream address for an MCP server. The registry stores that address as given. Later, when requests are proxied for that server, the gateway connects to the stored address on the user's behalf. If the address points to an internal service, such as the cloud metadata service, the gateway reaches it from inside the network and may relay the response back to the user.
Por que é vulnerável
The server registration and update API did not validate the upstream address of a registered server, so any destination was accepted, including internal ones. The registration API is trusted by design and often reachable by many authenticated users. Version 1.35.0 fixes this by validating upstream addresses when a server is registered or modified. It does not clean up entries stored earlier.
Onde está
The articles point to the server registration and update API of mcp-gateway-registry, fixed in release 1.35.0; they name no file or function.
Como foi descoberta
AWS credited external researcher novice-22 for coordinated disclosure. AWS published bulletin 2026-180-AWS and a GitHub advisory. The articles do not say how the researcher found the flaw. GBHackers notes that researchers recently observed MCP reconnaissance paired with cloud metadata SSRF to steal credentials, but does not say this flaw was exploited.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 04:15.
Linha do tempo
-
Authenticated SSRF Vulnerability in AWS MCP Gateway Registry Risks Internal Network Exposure
ler a análise desta fonte ocultar
AWS has disclosed a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-125926) in the open-source mcp-gateway-registry, used for Model Context Protocol (MCP) servers. The flaw allows authenticated users with permissions to register or modify servers to redirect gateway requests to internal network services, potentially exposing sensitive data such as cloud instance metadata and credentials. The vulnerability affects versions v1.0.3 through v1.34.0, and was fixed in version 1.35.0, which validates upstream addresses. This vulnerability is significant in cloud environments where abuse could lead to credential theft and lateral movement within the cloud account. AWS rates the security bulletin as "Important" with a high severity score of 8.5. Administrators are advised to upgrade to v1.35.0 and review existing server configurations for malicious entries, restrict registration permissions, enforce IMDSv2 on EC2, and rotate credentials if suspicious activity is detected. The flaw was responsibly disclosed by researcher novice-22.