AWS Warns of MCP Gateway Registry security flaw Allowing Attackers to Access Internal Network Services

What happened

AWS has disclosed a server-side request forgery (SSRF) flaw in mcp-gateway-registry, an open-source registry and gateway for Model Context Protocol (MCP) servers. Amazon Web Services is a cloud computing company based in Seattle.

Researchers recently observed MCP reconnaissance paired with cloud metadata SSRF to steal credentials.

Tracked as CVE-2026-125926 (the public catalogue number for a specific software flaw) under bulletin 2026-180-AWS, the issue lets an authenticated user make the gateway send requests to services on a deployment’s internal network. AWS CVE/vulnerability Cyber Security News 2 min.

AWS rates the bulletin “Important”, and the GitHub advisory scores it 8.5 (High) under CWE-918. AWS MCP Gateway Registry Vulnerability The registry centralizes discovery, access control, and proxying of registered MCP tool assets.

A vulnerability exists in the server registration and update API (the interface one piece of software uses to talk to another), which failed to validate the upstream address of a registered server. This flaw affects versions from v1.0.3 through v1.34.0.

Depending on network configuration, reachable targets can include the cloud instance metadata service and the credentials it issues. A registry running with an attached cloud role could therefore expose role credentials, letting an attacker move from application-layer abuse to wider cloud-account access.