CVE-2026-125926
Server-side request forgery in the server registration and update API in mcp-gateway-registry
CVSS Score
8.5
EPSS Score
0.0%
EPSS Percentile
0th
Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request. To remediate this issue, users should upgrade to version 1.35.0.
| CWE | CWE-918 |
| Vendor | aws |
| Product | mcp-gateway-registry |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for aws mcp-gateway-registry
Be the first to know when new high vulnerabilities affecting aws mcp-gateway-registry are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
AWS / mcp-gateway-registry
1.0.3 ≤ 1.34.0