AWS has recently identified a significant security vulnerability related to the mcp-gateway-registry, an open-source registry and gateway designed for Model Context Protocol (MCP) servers. The flaw, classified as a server-side request forgery (SSRF), has been assigned the CVE identifier CVE-2026-125926 and is documented under bulletin 2026-180-AWS. AWS has regarded this issue as "Important," while the GitHub advisory has rated it with a score of 8.5, indicating a "High" severity under the Common Weakness Enumeration (CWE) category 918.
Understanding the Vulnerability
The mcp-gateway-registry serves a crucial role in centralizing the discovery, access control, and proxying functions for registered MCP tool assets. The vulnerability is specifically located within the server registration and update API, where it has been found that the system fails to adequately validate the upstream address of any registered server. This means that an authenticated user, possessing the necessary permissions to register or modify servers, could potentially manipulate the registration process by redirecting the upstream address to an internal service.
Once this redirection occurs, the gateway could inadvertently send requests to that internal service. In some cases, this may lead to the gateway returning responses directly to the user, thereby opening a pathway for potential exploitation. The flaw encompasses versions from v1.0.3 through v1.34.0.
The Broader Implications
The risk of exploitation is particularly pronounced in cloud-based deployments. Depending on the specific network configurations in place, attackers could target sensitive resources, including the cloud instance’s metadata service and the associated credentials that it issues. This tactic has already been observed, with researchers documenting instances of MCP reconnaissance that accompany cloud metadata SSRF attacks aimed at credential theft. Consequently, if a registry operates with an attached cloud role, the exposure of role credentials could allow an attacker to escalate their access from application-layer exploitation to broader cloud-account infiltration.
This vulnerability is indicative of a larger trend within AI agent infrastructures, particularly concerning similar SSRF and authentication flaws previously identified in AWS’s Loom agent platform. In that instance, users with write permissions were capable of redirecting backend connections to internal endpoints. APIs that facilitate server registration and accept URLs are often prime targets for attackers due to their inherent trust from the system’s design and the need for accessibility by multiple authenticated users.
Remediation Actions
AWS has taken steps to address the flaw in version 1.35.0 of the mcp-gateway-registry, which now incorporates validation checks for upstream addresses during server registration or modification. However, administrators must exercise caution regarding version sequencing. A distinct management API vulnerability was rectified in version 1.25.0, meaning that deployments operating on version 1.25.0 or later will continue to remain vulnerable to the SSRF flaw until they are upgraded to version 1.35.0.
The release notes for version 1.35.0 detail specific upgrade procedures that include a notable change for Helm installations that utilize bundled Keycloak. These installations are required to adopt the keycloak-client-secret Secret before proceeding with the upgrade.
Additionally, it is important to note that upgrading will not automatically rectify any configurations that were set prior to the upgrade. The server entries that were recorded before the upgrade will remain unchanged. Therefore, customers who utilized a vulnerable version are urged to undertake the following steps:
- Review Upstream Addresses: Ensure that all registered server addresses are legitimate, and remove or correct any unintended entries.
- Examine Application Logs: Analyze application logs from the period prior to the upgrade for any irregular or unexpected server registrations and modifications.
- Evaluate Cloud Role Activity: If the registry is linked to a cloud role, and logs cannot rule out unexpected actions, it is imperative to review that role’s activities and rotate its credentials as a precaution.
For teams unable to effect an upgrade immediately, strategies exist to mitigate potential exposure. Limiting registration and modification permissions to a select group of trusted individuals and restricting outbound network access from the registry and authorization server components can diminish risk. On Amazon EC2, implementing the Instance Metadata Service version 2 (IMDSv2) is crucial, ensuring that each component’s role has only the necessary permissions. The importance of IMDSv2 is underscored by its capacity to mitigate risks associated with unauthenticated requests that SSRF attacks can exploit.
AWS has acknowledged external researcher novice-22 for their role in disclosing the vulnerability responsibly. With numerous instances of MCP servers already found to be vulnerable, it is critical for organizations to treat MCP registries as sensitive infrastructure. For any inquiries, contact can be directed to AWS’s dedicated communication channels.