Server-Side Request Forgery in Amazon MCP Gateway Registry
CVE-2026-125926

6.3MEDIUM

Key Information:

Vendor

Aws

Status
Mcp-gateway-registry
Vendor
CVE Published:
11 November 2026

What is CVE-2026-125926?

This vulnerability allows an authenticated remote user to exploit the server registration and update API of Amazon's MCP Gateway Registry, permitting them to send crafted requests that forward to internal network services and cloud instance metadata endpoints. This could potentially enable access to sensitive internal resources and data by extracting responses from these requests. The issue has been addressed in version 1.35.0, and users are advised to upgrade to this version to mitigate the risk.

Affected Version(s)

mcp-gateway-registry 1.0.3 <= 1.34.0

References

https://github.com/agentic-community/mcp-gateway-registry...
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.