MCP Gateway Registry: an SSRF and a path to registry admin

01What happened

AWS published bulletins 2026-180 and 2026-179 on November 11, 2026, covering two flaws in the MCP Gateway & Registry, the open-source gateway that brokers agent and assistant access to MCP servers. AWS credits the external researcher novice-22 for both, through coordinated disclosure. One fix shipped in version 1.25.0 and the other in 1.35.0, whose release page is dated October 29, 2026.

02How it works

The registry did not validate the upstream address of a registered server, so a user with permission to register or modify servers could point it at internal services and, in some cases, read the responses. The second flaw sat in the external management API, where the /api/servers/* endpoints checked that a caller was authenticated but never that the caller was authorized. A POST to /api/servers/groups/import therefore let a low-privileged user map their own identity-provider group to the registry administrator scope, and AWS says the new mapping took effect on that user's next request with no re-authentication.

03Who is affected

The request forgery covers the version range listed below, which reaches up to 1.34.0, and the authorization bypass covers an earlier range ending at 1.24.7. AWS notes that a deployment already running 1.25.0 or later, which closed the authorization bypass, stays exposed to the request forgery until it reaches 1.35.0.

04What to do

Upgrade to 1.35.0 or later, then review the upstream addresses of registered servers and check the mcp_scopes collection for group mappings nobody created on purpose. AWS says upgrading does not remove privileged mappings added while an affected version ran, and advises auditing HTTP logs for the exposure period and rotating registry-managed and attached cloud role credentials where unexpected access cannot be ruled out.

Questions people ask

Which MCP Gateway & Registry version fixes CVE-2026-125926?

Version 1.35.0 fixes CVE-2026-125926. AWS says the release validates upstream addresses when a server is registered or modified, and that every version from 1.0.3 through 1.34.0 is affected. Running 1.25.0 or later is not enough on its own, because that earlier release closed a separate authorization flaw and left the request forgery in place.

Does upgrading undo the privilege escalation in CVE-2026-100307?

Upgrading does not undo it. AWS states that moving to 1.25.0 or later stops new abuse but leaves behind any privileged group mappings created while an affected version was running, and does not invalidate credentials read beforehand. AWS advises reviewing the mcp_scopes collection, auditing HTTP logs for the exposure period, and rotating registry-managed credentials where unintended access cannot be ruled out.

Who can exploit the MCP Gateway & Registry request forgery?

An authenticated user who already holds permission to register or modify servers can exploit it. AWS describes the result as the gateway sending requests to internal network services, with responses reaching the caller in some cases. As interim controls, AWS suggests limiting registration rights to trusted accounts, restricting outbound network access from the registry and auth server, and requiring IMDSv2 on EC2.

Sources 3 links, all fetched

1. 1aws.amazon.comAWS Bulletin 2026-180
2. 2aws.amazon.comAWS Bulletin 2026-179
3. 3github.comRelease 1.35.0