AWS MCP Gateway Security Flaw Allowing Access to Internal Networks and Cloud Credentials

AWS has fixed a server-side request forgery flaw in mcp-gateway-registry that could let an authenticated attacker reach internal services through the gateway.

Tracked as CVE-2026-125926, the issue affects versions 1.0.3 through 1.34.0. Version 1.35.0 contains the fix. AWS disclosed the vulnerability on November 11, 2026, and urged users to upgrade.

The open-source project acts as a registry and gateway for Model Context Protocol servers. It brings server discovery, access control, and tool proxying into one place.

The flaw affects how the registry checks the upstream address supplied when a user registers a server or updates an existing entry.

AWS MCP Gateway Security Flaw

An attacker must already have a valid account with permission to register or modify servers. By setting a crafted upstream address, that user could make the gateway send requests to services inside the deployment’s network.

In some cases, the gateway also returned the responses, allowing the attacker to read information from those services. This is not an unauthenticated attack against every exposed gateway. The key risk comes from giving a permitted user control over where the gateway connects.

Requests then leave from the gateway’s network position, potentially reaching systems that the user could not contact directly. The impact depends on which services the deployment can reach.

Cloud credentials are another concern when the gateway runs with an attached cloud role. Related EC2 metadata attacks show how SSRF can expose temporary role credentials through unprotected metadata access.

However, AWS’s bulletin does not confirm credential theft or active exploitation of this specific flaw. It credits researcher novice-22 for coordinated disclosure.

According to the AWS security bulletin, version 1.35.0 checks upstream addresses during server registration and modification. Crucially, it leaves previously stored server settings unchanged.

Administrators should review existing upstream addresses after upgrading and correct or remove any destination they did not intend to allow. Teams should also examine application logs covering the time an affected version was running. Unexpected server registrations or address changes deserve review.

If the registry has an attached cloud role and the logs cannot rule out unexpected activity, AWS advises checking that role’s activity and rotating its credentials.

The version 1.35.0 release is the minimum fixed release for this issue. A separate flaw in the external management API was fixed in version 1.25.0. That earlier update does not protect against CVE-2026-125926, so deployments on versions 1.25.0 through 1.34.0 remain affected. Forks and derived projects also need the fix.

For teams unable to patch immediately, AWS recommends limiting registration and editing rights to trusted accounts, restricting outbound connections from the registry and auth-server components, requiring IMDSv2 on EC2, and reducing attached role permissions.

These controls also address risks highlighted by scans targeting MCP servers, but they do not replace upgrading and reviewing stored configurations.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post AWS MCP Gateway Security Flaw Allowing Access to Internal Networks and Cloud Credentials appeared first on Cyber Security News.