AWS MCP Gateway Security Flaw Allowing Access to Internal Networks and Cloud Credentials
AWS MCP Gateway registry flaw (CVE-2026-125926) allows authenticated attackers to access internal networks and cloud
AWS has patched a server-side request forgery vulnerability in its mcp-gateway-registry, tracked as CVE-2026-125926. The flaw, affecting versions 1.0.3 through 1.34.0, allows authenticated users to make the gateway send requests to internal services and potentially access cloud credentials if the gateway has an attached cloud role. Version 1.35.0 includes the fix, and AWS urges users to upgrade and review existing configurations.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AWS?
Get an email when a new story names AWS, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA server-side request forgery (SSRF) vulnerability in AWS's mcp-gateway-registry allowed authenticated users to coerce the gateway into making internal requests on their behalf, potentially reaching cloud metadata services and harvesting attached IAM role credentials. This is a classic SSRF risk that is amplified in cloud environments where instance metadata endpoints (e.g., IMDSv1) can expose powerful credentials without additional authentication. The vulnerability persisted across a wide version range (1.0.3–1.34.0), indicating that SSRF protections were not part of the original design or review process. The incident underscores how a single unvalidated outbound request path in an internet-facing service can pivot into full cloud account compromise if roles are over-permissioned or metadata protections are absent.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-125926