AWS has disclosed a server-side request forgery (SSRF) flaw in mcp-gateway-registry, an open-source registry and gateway for Mannequin Context Protocol (MCP) servers.
Tracked as CVE-2026-125926 underneath bulletin 2026-180-AWS, the difficulty lets an authenticated person make the gateway ship requests to providers on a deployment’s inner community. AWS charges the bulletin “Essential”, and the GitHub advisory scores it 8.5 (Excessive) underneath CWE-918.
AWS MCP Gateway Registry Vulnerability
The registry centralizes discovery, entry management, and proxying of registered MCP software belongings. A vulnerability exists within the server registration and replace API, which didn’t validate the upstream handle of a registered server. A person with permission to register or modify servers might probably redirect that handle to an inner service.
Because of this, the gateway may ship requests to this service and, in some cases, return responses on to the person. This flaw impacts variations from v1.0.3 via v1.34.0.
The danger grows in cloud deployments. Relying on community configuration, reachable targets can embrace the cloud occasion metadata service and the credentials it points.
Attackers already goal this path. Researchers just lately noticed MCP reconnaissance paired with cloud metadata SSRF to steal credentials. A registry working with an hooked up cloud position might subsequently expose position credentials, letting an attacker transfer from application-layer abuse to wider cloud-account entry.
The flaw additionally matches a broader sample in AI agent infrastructure. AWS just lately mounted related SSRF and authentication flaws in its Loom agent platform, the place customers with write scopes might redirect backend connections to inner endpoints. Registration APIs that settle for URLs are enticing targets as a result of they’re trusted by design and are sometimes reachable by many authenticated customers.
AWS mounted the difficulty in model 1.35.0, which validates upstream addresses when a server is registered or modified. Directors also needs to notice a version-sequencing entice. A separate administration API problem was mounted in 1.25.0.
Nevertheless, deployments on 1.25.0 or later keep susceptible to this flaw till they attain 1.35.0. The 1.35.0 launch notes cowl the improve steps. These embrace a breaking change for Helm installs with bundled Keycloak, which should undertake the keycloak-client-secret Secret earlier than upgrading.
The improve doesn’t clear up earlier configurations. Server entries saved earlier than the improve keep unchanged, so clients who ran an affected model ought to take these steps:
- Evaluate the upstream addresses of registered servers, and proper or take away any handle they didn’t intend.
- Evaluate software logs from the affected interval for surprising server registrations and adjustments.
- If the registry runs with an hooked up cloud position and the logs can not rule out surprising exercise, assessment that position’s exercise and rotate its credentials.
Groups that can’t improve but can cut back publicity. They will restrict registration and modification rights to trusted accounts and limit outbound community entry from the registry and auth-server parts.
On Amazon EC2, they need to require IMDSv2 and grant every element’s position solely the permissions it wants. IMDS abuse for cloud preliminary entry reveals why IMDSv2 issues, since IMDSv1 accepts unauthenticated requests that SSRF can exploit. These measures don’t change the post-upgrade actions.
AWS credited exterior researcher novice-22 for coordinated disclosure. With hundreds of MCP servers already discovered susceptible, defenders ought to deal with MCP registries as delicate infrastructure. Questions can go to [email protected].
Give your SOC the alert context on the most recent threats to cease incidents rapidly -> Combine Risk Intel from 16K SOCs:
