{"id":"CVE-2026-125926","kind":"vulnerability","aliases":["CVE-2026-125926"],"related":[],"title":"Amazon mcp-gateway-registry: authenticated users can trigger internal network requests","description":"CVE-2026-125926 - Server-side request forgery in the server registration and update API in mcp-gateway-registry\n\n### CVE-2026-125926 - Server-side request forgery in the server registration and update API in mcp-gateway-registry\n\nBulletin ID: 2026-180-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/11/2026 13:00 PM PST\n\n Description:\n\nmcp-gateway-registry is an open-source registry and gateway for Model Context Protocol (MCP) servers that centralizes discovery, access control, and proxying of registered MCP tool assets. We identified CVE-2026-125926, a server-side request forgery issue in how the registry validates the upstream address of a registered server.\n\nAn authenticated user with permission to register or modify a server could configure an upstream address that caused the gateway to send requests to services on the deployment's internal network. In some cases the gateway returned those responses to the user.\n\nImpacted versions: >= v1.0.3 AND <= 1.34.0\n\nResolution:\n\nThis issue has been addressed in mcp-gateway-registry version 1.35.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nNote on version sequencing: a separate and unrelated issue in this product's external management API was addressed in version 1.25.0. A deployment running 1.25.0 or later carries that fix, but remains affected by the issue described here until it runs version 1.35.0 or later.\n\nPost-upgrade actions:\n\nVersion 1.35.0 validates server upstream addresses when a server is registered or modified. It leaves server configurations stored before the upgrade unchanged. Customers who ran an affected version should take the following steps after upgrading:\n\n1. Review the upstream addresses of registered servers, and correct or remove any address you did not intend.\n2. Review application logs from the period an affected version was deployed for unexpected server registrations and changes.\n3. If the registry runs with an attached cloud role and the log review cannot rule out unexpected activity, review that role's activity and rotate its credentials.\n\nWorkarounds:\n\nThe following measures limit risk for deployments that cannot yet upgrade. They do not replace the post-upgrade actions above:\n\n- Limit the permission to register and modify servers to trusted accounts.\n- Restrict outbound network access from the registry and auth-server components to the destinations they need.\n- On Amazon EC2, require IMDSv2. Grant the role attached to each component only the permissions it needs.\n\nReferences:\n\n- CVE-2026-125926\n- GHSA-fc39-fwh3-wv5r\n\nAcknowledgement:\n\nWe would like to thank the external researcher (handle novice-22) for collaborating on this issue through the coordinated disclosure process.\n\n Please email aws-security@amazon.com with any s ecurity questions or concerns.","summary":"The mcp-gateway-registry, an open-source registry and gateway for MCP servers, does not validate the upstream address of a registered server, so a user allowed to register or modify servers can make the gateway send requests to services on the internal network. In some cases the gateway returns those responses to the user.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","aws","lab-disclosure","mcp","python","self-hosted"],"not_affected_if":["auth-required","version-1.35.0-or-later"],"how_to_check":"- Check the installed mcp-gateway-registry version; versions `>= 1.0.3` and `<= 1.34.0` are affected.\n- Review registered server upstream addresses for any internal or unintended destinations.\n- Review application logs from the period an affected version was deployed for unexpected server registrations and changes.","fix":"- mcp-gateway-registry: move to `1.35.0` or later.\n- Version `1.35.0` validates upstream addresses on registration and modification but does not change configurations stored before the upgrade; review those manually.","status":"open","published_at":"2026-11-11T00:00:00+00:00","first_seen_at":"2026-11-11T21:28:41+00:00","triaged_at":"2026-11-11T21:30:41+00:00","updated_at":"2026-11-11T21:30:41+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-11T21:30:41Z","model":"claude-haiku-5-5","output":{"fix":"- mcp-gateway-registry: move to `1.35.0` or later.\n- Version `1.35.0` validates upstream addresses on registration and modification but does not change configurations stored before the upgrade; review those manually.","reach":"network","title":"Amazon mcp-gateway-registry: authenticated users can trigger internal network requests","impact":"medium","summary":"The mcp-gateway-registry, an open-source registry and gateway for MCP servers, does not validate the upstream address of a registered server, so a user allowed to register or modify servers can make the gateway send requests to services on the internal network. In some cases the gateway returns those responses to the user.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["mcp","aws","self-hosted","python"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"internal services reached through the gateway, responses returned to the user","analyst_note":"","how_to_check":"- Check the installed mcp-gateway-registry version; versions `>= 1.0.3` and `<= 1.34.0` are affected.\n- Review registered server upstream addresses for any internal or unintended destinations.\n- Review application logs from the period an affected version was deployed for unexpected server registrations and changes.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["auth-required","version-1.35.0-or-later"],"who_is_affected":"Deployments of mcp-gateway-registry from 1.0.3 through 1.34.0 are exposed, and the flaw requires an account allowed to register or modify servers. Version 1.25.0 fixed a separate issue but does not fix this one, so 1.35.0 or later is needed. If the registry runs with an attached cloud role and logs cannot rule out unexpected activity, review that role's activity and rotate its credentials.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000892,"input_tokens":5558,"output_tokens":672,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125926':15A,18A,90C,110C,182C,501C '-180':131C '-2026':14A,17A,89C,109C,181C,500C '-22':518C '00':144C '1':367C '1.25.0':303C,307C '1.34.0':248C '1.35.0':261C,325C,333C '11/11/2026':142C '13':143C '2':385C '2026':130C '3':403C 'access':169C,467C 'account':463C 'acknowledg':507C 'action':331C,451C 'activ':421C,426C 'address':51B,197C,217C,254C,300C,337C,371C,380C 'affect':315C,358C,393C 'ai':20B 'ai-tool':19B 'allow':59B 'amazon':1A,482C 'api':102C,122C,298C 'applic':387C 'asset':177C 'attach':410C,489C 'attent':139C 'auth':473C 'auth-serv':472C 'authent':6A,203C 'aw':22B,132C,134C 'aws-security@amazon.com':531C 'bulletin':128C 'cannot':417C,440C 'carri':310C 'case':79B,235C 'caus':219C 'central':167C 'chang':402C 'cloud':411C 'code':275C 'collabor':520C 'compon':475C,492C 'concern':538C 'configur':214C,348C 'content':135C 'context':162C 'control':170C 'coordin':526C 'correct':376C 'could':213C 'credenti':430C 'custom':354C 'cve':13A,16A,88C,108C,180C,499C 'date':141C 'deploy':229C,305C,396C,438C 'deriv':274C 'describ':319C 'descript':147C 'destin':478C 'disclosur':25B,527C 'discoveri':168C 'ec2':483C 'ecur':535C 'email':530C 'ensur':270C 'extern':296C,514C 'fc39':504C 'fix':282C,312C 'follow':363C,433C 'forgeri':95C,115C,188C 'fork':272C 'fwh3':505C 'gateway':4A,34B,42B,68B,81B,106C,126C,150C,159C,221C,237C,258C 'ghsa':503C 'ghsa-fc39-fwh3-wv5r':502C 'grant':486C 'handl':516C 'host':30B 'id':129C 'identifi':179C 'imdsv2':485C 'impact':244C 'import':137C 'incorpor':279C 'intend':384C 'intern':10A,75B,231C 'issu':189C,251C,291C,318C,523C 'lab':24B 'lab-disclosur':23B 'later':309C,327C 'latest':267C 'leav':346C 'like':510C 'limit':435C,453C 'log':388C,415C 'make':66B 'manag':297C 'mcp':3A,26B,33B,44B,105C,125C,149C,164C,175C,257C 'mcp-gateway-registri':2A,32B,104C,124C,148C,256C 'measur':434C 'model':161C 'modifi':63B,210C,344C,459C 'need':480C,497C 'network':11A,76B,232C,466C 'new':281C 'note':283C 'novic':517C 'open':38B,155C 'open-sourc':37B,154C 'outbound':465C 'patch':277C 'period':391C 'permiss':206C,455C,495C 'pleas':529C 'pm':145C 'post':329C,449C 'post-upgrad':328C,448C 'process':528C 'product':294C 'protocol':163C 'proxi':172C 'pst':146C 'public':140C 'python':27B 'question':536C 'ran':356C 'recommend':263C 'refer':498C 'regist':54B,61B,174C,200C,208C,342C,373C,457C 'registr':99C,119C,400C 'registri':5A,35B,40B,107C,127C,151C,157C,193C,259C,406C,470C 'remain':314C 'remov':378C 'replac':446C 'request':12A,70B,94C,114C,187C,224C 'requir':138C,484C 'research':515C 'resolut':249C 'respons':84B,240C 'restrict':464C 'return':82B,238C 'review':368C,386C,416C,422C 'risk':436C 'role':412C,424C,488C 'rotat':428C 'rule':418C 'run':306C,323C,407C 'scope':133C 'self':29B 'self-host':28B 'send':69B,223C 'separ':288C 'sequenc':286C 'server':45B,55B,64B,92C,98C,112C,118C,165C,185C,201C,212C,335C,340C,347C,374C,399C,460C,474C 'server-sid':91C,111C,184C 'servic':72B,226C 'side':93C,113C,186C 'sourc':39B,156C 'step':364C 'store':349C 'take':361C 'thank':512C 'tool':21B,176C 'trigger':9A 'trust':462C 'type':136C 'unchang':353C 'unexpect':398C,420C 'unrel':290C 'updat':101C,121C 'upgrad':264C,330C,352C,366C,442C,450C 'upstream':50B,196C,216C,336C,370C 'user':7A,58B,87B,204C,243C 'v1.0.3':246C 'valid':48B,194C,334C 'version':245C,260C,268C,285C,302C,324C,332C,359C,394C 'workaround':431C 'would':509C 'wv5r':506C 'yet':441C","nicknames":[],"mitigations":[],"who_affected":"Deployments of mcp-gateway-registry from 1.0.3 through 1.34.0 are exposed, and the flaw requires an account allowed to register or modify servers. Version 1.25.0 fixed a separate issue but does not fix this one, so 1.35.0 or later is needed. If the registry runs with an attached cloud role and logs cannot rule out unexpected activity, review that role's activity and rotate its credentials.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","aws","high","labdisclosure","mcp","python","selfhosted"],"campaign_type":null,"search_a":"'-125926':15A,18A '-2026':14A,17A 'amazon':1A 'authent':6A 'cve':13A,16A 'gateway':4A 'intern':10A 'mcp':3A 'mcp-gateway-registri':2A 'network':11A 'registri':5A 'request':12A 'trigger':9A 'user':7A","search_b":"'address':51B 'ai':20B 'ai-tool':19B 'allow':59B 'aw':22B 'case':79B 'disclosur':25B 'gateway':34B,42B,68B,81B 'host':30B 'intern':75B 'lab':24B 'lab-disclosur':23B 'make':66B 'mcp':26B,33B,44B 'mcp-gateway-registri':32B 'modifi':63B 'network':76B 'open':38B 'open-sourc':37B 'python':27B 'regist':54B,61B 'registri':35B,40B 'request':70B 'respons':84B 'return':82B 'self':29B 'self-host':28B 'send':69B 'server':45B,55B,64B 'servic':72B 'sourc':39B 'tool':21B 'upstream':50B 'user':58B,87B 'valid':48B","search_c":"'-125926':90C,110C,182C,501C '-180':131C '-2026':89C,109C,181C,500C '-22':518C '00':144C '1':367C '1.25.0':303C,307C '1.34.0':248C '1.35.0':261C,325C,333C '11/11/2026':142C '13':143C '2':385C '2026':130C '3':403C 'access':169C,467C 'account':463C 'acknowledg':507C 'action':331C,451C 'activ':421C,426C 'address':197C,217C,254C,300C,337C,371C,380C 'affect':315C,358C,393C 'amazon':482C 'api':102C,122C,298C 'applic':387C 'asset':177C 'attach':410C,489C 'attent':139C 'auth':473C 'auth-serv':472C 'authent':203C 'aw':132C,134C 'aws-security@amazon.com':531C 'bulletin':128C 'cannot':417C,440C 'carri':310C 'case':235C 'caus':219C 'central':167C 'chang':402C 'cloud':411C 'code':275C 'collabor':520C 'compon':475C,492C 'concern':538C 'configur':214C,348C 'content':135C 'context':162C 'control':170C 'coordin':526C 'correct':376C 'could':213C 'credenti':430C 'custom':354C 'cve':88C,108C,180C,499C 'date':141C 'deploy':229C,305C,396C,438C 'deriv':274C 'describ':319C 'descript':147C 'destin':478C 'disclosur':527C 'discoveri':168C 'ec2':483C 'ecur':535C 'email':530C 'ensur':270C 'extern':296C,514C 'fc39':504C 'fix':282C,312C 'follow':363C,433C 'forgeri':95C,115C,188C 'fork':272C 'fwh3':505C 'gateway':106C,126C,150C,159C,221C,237C,258C 'ghsa':503C 'ghsa-fc39-fwh3-wv5r':502C 'grant':486C 'handl':516C 'id':129C 'identifi':179C 'imdsv2':485C 'impact':244C 'import':137C 'incorpor':279C 'intend':384C 'intern':231C 'issu':189C,251C,291C,318C,523C 'later':309C,327C 'latest':267C 'leav':346C 'like':510C 'limit':435C,453C 'log':388C,415C 'manag':297C 'mcp':105C,125C,149C,164C,175C,257C 'mcp-gateway-registri':104C,124C,148C,256C 'measur':434C 'model':161C 'modifi':210C,344C,459C 'need':480C,497C 'network':232C,466C 'new':281C 'note':283C 'novic':517C 'open':155C 'open-sourc':154C 'outbound':465C 'patch':277C 'period':391C 'permiss':206C,455C,495C 'pleas':529C 'pm':145C 'post':329C,449C 'post-upgrad':328C,448C 'process':528C 'product':294C 'protocol':163C 'proxi':172C 'pst':146C 'public':140C 'question':536C 'ran':356C 'recommend':263C 'refer':498C 'regist':174C,200C,208C,342C,373C,457C 'registr':99C,119C,400C 'registri':107C,127C,151C,157C,193C,259C,406C,470C 'remain':314C 'remov':378C 'replac':446C 'request':94C,114C,187C,224C 'requir':138C,484C 'research':515C 'resolut':249C 'respons':240C 'restrict':464C 'return':238C 'review':368C,386C,416C,422C 'risk':436C 'role':412C,424C,488C 'rotat':428C 'rule':418C 'run':306C,323C,407C 'scope':133C 'send':223C 'separ':288C 'sequenc':286C 'server':92C,98C,112C,118C,165C,185C,201C,212C,335C,340C,347C,374C,399C,460C,474C 'server-sid':91C,111C,184C 'servic':226C 'side':93C,113C,186C 'sourc':156C 'step':364C 'store':349C 'take':361C 'thank':512C 'tool':176C 'trust':462C 'type':136C 'unchang':353C 'unexpect':398C,420C 'unrel':290C 'updat':101C,121C 'upgrad':264C,330C,352C,366C,442C,450C 'upstream':196C,216C,336C,370C 'user':204C,243C 'v1.0.3':246C 'valid':194C,334C 'version':245C,260C,268C,285C,302C,324C,332C,359C,394C 'workaround':431C 'would':509C 'wv5r':506C 'yet':441C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/2026-180-aws/#CVE-2026-125926","url":"https://aws.amazon.com/security/security-bulletins/2026-180-aws/","severity":null,"published_at":"2026-11-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-11T21:28:41+00:00","fetched_at":"2026-11-11T21:28:41+00:00","note":"AWS: CVE-2026-125926 - Server-side request forgery in the server registration and update API in mcp-gateway-registry"},{"source":"nvd","external_id":"CVE-2026-125926","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125926","severity":null,"published_at":"2026-11-11T21:16:42+00:00","modified_at":"2026-11-11T21:16:42+00:00","first_seen_at":"2026-11-11T21:29:07+00:00","fetched_at":"2026-11-11T21:29:09+00:00","note":null}],"documents":[{"id":128949,"url":"https://aws.amazon.com/security/security-bulletins/2026-180-aws/","title":"AWS: CVE-2026-125926 - Server-side request forgery in the server registration and update API in mcp-gateway-registry","kind":"advisory","source":"lab","publisher":"research","text":"CVE-2026-125926 - Server-side request forgery in the server registration and update API in mcp-gateway-registry\n\n### CVE-2026-125926 - Server-side request forgery in the server registration and update API in mcp-gateway-registry\n\nBulletin ID: 2026-180-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/11/2026 13:00 PM PST\n\n Description:\n\nmcp-gateway-registry is an open-source registry and gateway for Model Context Protocol (MCP) servers that centralizes discovery, access control, and proxying of registered MCP tool assets. We identified CVE-2026-125926, a server-side request forgery issue in how the registry validates the upstream address of a registered server.\n\nAn authenticated user with permission to register or modify a server could configure an upstream address that caused the gateway to send requests to services on the deployment's internal network. In some cases the gateway returned those responses to the user.\n\nImpacted versions: >= v1.0.3 AND <= 1.34.0\n\nResolution:\n\nThis issue has been addressed in mcp-gateway-registry version 1.35.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nNote on version sequencing: a separate and unrelated issue in this product's external management API was addressed in version 1.25.0. A deployment running 1.25.0 or later carries that fix, but remains affected by the issue described here until it runs version 1.35.0 or later.\n\nPost-upgrade actions:\n\nVersion 1.35.0 validates server upstream addresses when a server is registered or modified. It leaves server configurations stored before the upgrade unchanged. Customers who ran an affected version should take the following steps after upgrading:\n\n1. Review the upstream addresses of registered servers, and correct or remove any address you did not intend.\n2. Review application logs from the period an affected version was deployed for unexpected server registrations and changes.\n3. If the registry runs with an attached cloud role and the log review cannot rule out unexpected activity, review that role's activity and rotate its credentials.\n\nWorkarounds:\n\nThe following measures limit risk for deployments that cannot yet upgrade. They do not replace the post-upgrade actions above:\n\n- Limit the permission to register and modify servers to trusted accounts.\n- Restrict outbound network access from the registry and auth-server components to the destinations they need.\n- On Amazon EC2, require IMDSv2. Grant the role attached to each component only the permissions it needs.\n\nReferences:\n\n- CVE-2026-125926\n- GHSA-fc39-fwh3-wv5r\n\nAcknowledgement:\n\nWe would like to thank the external researcher (handle novice-22) for collaborating on this issue through the coordinated disclosure process.\n\n Please email aws-security@amazon.com with any s ecurity questions or concerns.","published_at":"2026-11-11T00:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":128956,"url":"https://github.com/agentic-community/mcp-gateway-registry/releases/tag/1.35.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129142,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-180-aws/","title":"AWS Security Bulletins: CVE-2026-125926 - Server-side request forgery in the server registration and update API in mcp-gateway-registry","kind":"vendor","source":"vendor","publisher":null,"text":"CVE-2026-125926 - Server-side request forgery in the server registration and update API in mcp-gateway-registry\n\nBulletin ID: 2026-180-AWS Publication Date: 11/11/2026 13:00 PM PST Description: MServer-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request Impacted versions: >= v1.0.3 AND <= 1.34.0 Refer to the article for the most up-to-date and complete information.","published_at":"2026-11-11T21:04:56+00:00","relation":"advisory","confidence":null,"note":"AWS Security Bulletins"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}