Skip to content

An editorial team and a community building with AI

vibecoding.incJoin Discord ↗
← All articles

News · Amazon (AWS) · 2 min read

Event date: · Published:

AWS patches SSRF and privilege escalation flaws in MCP Gateway Registry

AWS disclosed and fixed two high-severity vulnerabilities in its open-source mcp-gateway-registry tool, including an SSRF flaw and a missing-authorization bug that let an authenticated user gain full registry-administrator control.

AWS Security disclosed and patched two high-severity vulnerabilities in mcp-gateway-registry, its open-source reference gateway for managing fleets of MCP servers, on November 11, 2026, detailed in a security bulletin for CVE-2026-125926.

What changed

  • CVE-2026-125926 is a server-side request forgery (SSRF) flaw in the server-registration and update API, rated CVSS 3.1 8.5 (High); it affects versions 1.0.3 through 1.34.0 and is fixed in version 1.35.0.
  • CVE-2026-100307 is a missing-authorization flaw on the external management API, detailed in AWS's security bulletin for CVE-2026-100307, rated CVSS 8.8 (v3.1) / 8.7 (v4.0); it affects versions 1.0.9 through 1.24.7 and is fixed in version 1.25.0.
  • The SSRF flaw let an authenticated user with server-registration rights point the gateway's upstream address at internal network services or cloud metadata endpoints.
  • The authorization flaw could be triggered with a crafted POST request to /api/servers/groups/import that maps an attacker-controlled identity-provider group to the registry-administrator scope, as described in the GitHub Security Advisory for the privilege-escalation flaw.
  • Both flaws required authentication but no special privileges; AWS reports no known in-the-wild exploitation and credits researcher novice-22 under coordinated disclosure with AWS Security.

What it means for people who build with AI

mcp-gateway-registry serves as AWS's reference gateway for centralizing enterprise access to fleets of MCP servers. On an unpatched instance, a user with only server-registration rights could combine both flaws to pivot to full registry-administrator control over every registered MCP server, and reach internal network services or cloud metadata endpoints that should otherwise be unreachable from the gateway.

What to do next

  • Upgrade mcp-gateway-registry to version 1.35.0 or later to close the SSRF flaw, and to version 1.25.0 or later to close the authorization flaw.
  • Audit logs and identity-provider group-to-scope mappings for signs of unauthorized changes.
  • Rotate registry-managed credentials if compromise cannot be ruled out.

Sources

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.

AWS patches SSRF and privilege escalation flaws in MCP Gateway Registry | vibecoding.inc