MCP-GATEWAY-REGISTRY · GHSA-fc39-fwh3-wv5r · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
The MCP gateway registry lets a user who can register or modify a server set an upstream address that the gateway then requests, including services on the deployment's internal network. In some cases the gateway returns those responses to the user, so internal data can leak.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Deployments of mcp-gateway-registry at version 1.0.3 through 1.34.0 are exposed, especially where users other than trusted administrators can register or change MCP servers. The risk is greatest when the registry or auth-server runs on a network with internal services or on Amazon EC2 with an attached cloud role. Deployments on 1.35.0 or later are not affected by this issue, though stored configurations from before the upgrade need review.
Not affected if no-internal-network-services, trusted-registrars-only, version-1.35.0-or-later
Who cares aws, ec2, lab-disclosure, mcp, self-hosted
mcp-gateway-registry version; versions >= 1.0.3 and <= 1.34.0 are affected.mcp-gateway-registry or later; this version validates upstream addresses on registration and modification, but does not change server configurations stored before the upgrade.CVE-2026-125926 - Server-side request forgery in the server registration and update API in mcp-gateway-registry
Bulletin ID: 2026-180-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/11/2026 13:00 PM PST
Description:
mcp-gateway-registry is an open-source registry and gateway for Model Context Protocol (MCP) servers that centralizes discovery, access control, and proxying of registered MCP tool assets. We identified CVE-2026-125926, a server-side request forgery issue in how the registry validates the upstream address of a registered server.
An authenticated user with permission to register or modify a server could configure an upstream address that caused the gateway to send requests to services on the deployment's internal network. In some cases the gateway returned those responses to the user.
Impacted versions: >= v1.0.3 AND <= 1.34.0
Resolution:
This issue has been addressed in mcp-gateway-registry version 1.35.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Note on version sequencing: a separate and unrelated issue in this product's external management API was addressed in version 1.25.0. A deployment running 1.25.0 or later carries that fix, but remains affected by the issue described here until it runs version 1.35.0 or later.
Post-upgrade actions:
Version 1.35.0 validates server upstream addresses when a server is registered or modified. It leaves server configurations stored before the upgrade unchanged. Customers who ran an affected version should take the following steps after upgrading:
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
1.35.0Workarounds:
The following measures limit risk for deployments that cannot yet upgrade. They do not replace the post-upgrade actions above:
References:
Acknowledgement:
We would like to thank the external researcher (handle novice-22) for collaborating on this issue through the coordinated disclosure process.
Please email aws-security@amazon.com with any s ecurity questions or concerns.