SSRF Flaw in AWS MCP Gateway Exposed Internal Networks and Cloud Credentials
Written by AI from the linked story. Not reviewed by an editor. How this works
A server-side request forgery (SSRF) vulnerability in AWS's mcp-gateway-registry allowed authenticated users to coerce the gateway into making internal requests on their behalf, potentially reaching cloud metadata services and harvesting attached IAM role credentials. This is a classic SSRF risk that is amplified in cloud environments where instance metadata endpoints (e.g., IMDSv1) can expose powerful credentials without additional authentication. The vulnerability persisted across a wide version range (1.0.3–1.34.0), indicating that SSRF protections were not part of the original design or review process. The incident underscores how a single unvalidated outbound request path in an internet-facing service can pivot into full cloud account compromise if roles are over-permissioned or metadata protections are absent.
Tactical Insight
Immediate actions
- Upgrade all mcp-gateway-registry deployments to version 1.35.0 or later immediately.
- Audit IAM roles attached to the gateway service and restrict permissions to the minimum required.
- Enable IMDSv2 (token-required mode) on all EC2 instances to limit metadata endpoint exposure via SSRF.
Long-term improvements
- Integrate SSRF-specific testing (e.g., blind SSRF probes against internal endpoints) into the SDLC for all internet-facing services.
- Enforce allowlist-based egress controls on gateway components so they can only reach explicitly approved destinations.
- Apply the principle of least privilege to all cloud roles and rotate credentials on a scheduled basis.
Detection measures
- Monitor outbound requests from gateway services for unexpected destinations such as 169.254.169.254 or internal RFC-1918 addresses.
- Alert on any retrieval of cloud credentials or IAM token requests originating from the gateway process.
- Review gateway access logs regularly for authenticated users making unusual or high-volume internal requests.