AWS has recently addressed a critical server-side request forgery (SSRF) vulnerability in the Model Context Protocol (MCP) Gateway, known to potentially expose internal networks and cloud credentials. The flaw, identified as CVE-2026-125926, affects versions 1.0.3 through 1.34.0, with the issue resolved in version 1.35.0. AWS announced the vulnerability on November 11, 2026, urging users to update to the latest version.
Understanding the MCP Gateway Flaw
The MCP Gateway serves as a hub for registry and gateway functionalities for Model Context Protocol servers, integrating server discovery, access control, and tool proxying. The security issue arises from the way the registry processes upstream addresses when users register or modify server entries. An attacker with an authenticated account could exploit this flaw by providing a manipulated upstream address, thereby directing the gateway to send requests to internal network services.
This vulnerability primarily poses a risk by allowing an authenticated user to leverage the gateway’s network position to communicate with systems otherwise unreachable. In certain scenarios, the gateway might return service responses to the attacker, potentially exposing sensitive information. However, this does not pose a risk to all openly accessible gateways, as it requires existing user permissions on the network.
Potential Risks and Implications
The flaw also raises concerns around cloud credentials, especially when the MCP gateway operates with an associated cloud role. The vulnerability could expose temporary role credentials through EC2 metadata attacks if metadata access is not adequately protected. Despite the potential for credential exposure, AWS has not confirmed any such incidents arising from this vulnerability.
AWS has credited the researcher novice-22 for the coordinated disclosure of the flaw. In response, version 1.35.0 introduces checks for upstream addresses during server registration and modification, preventing unintended network access. Administrators are advised to review existing upstream addresses post-upgrade to ensure no unauthorized entries remain.
Recommendations for Mitigation
To mitigate risks, AWS recommends that administrators review application logs for unusual server registrations or address modifications during the period when vulnerable versions were in use. If a registry has an associated cloud role and logs indicate unexpected activities, it is crucial to examine the role’s actions and rotate its credentials.
For teams unable to immediately apply the update, AWS advises restricting registration and editing permissions to trusted accounts, limiting outbound connections from registry components, enforcing IMDSv2 on EC2, and minimizing attached role permissions. While these measures can reduce risk, they do not substitute for the critical update and thorough review of stored configurations.
In conclusion, addressing this vulnerability is essential for maintaining the security of AWS MCP Gateway deployments. Administrators should prioritize updating to version 1.35.0 and implementing recommended security measures to safeguard their networks against potential exploits.
