L3 · ShartedAWS · MCP · SSRF · authorizationmcp-gateway-registry-access

MCP Gateway Registry flaws grant admin access and expose internal services

Two flaws in the open-source mcp-gateway-registry let a low-privileged authenticated user obtain registry admin rights and let a user with server-write permissions send internal requests. Upgrade to 1.35.0 or later and audit stored configuration.

Disclosed: Nov 11, 2026; Public disclosure date
Severity: Sharted; 2 CVEs tracked here
Splash zone: Affected mcp-gateway-registry deployments with authenticated users. The SSRF path requires server registration or update rights.; AWS · MCP · SSRF · authorization
In the wild: Unknown; The AWS bulletins do not report exploitation in the wild.

What happened

AWS disclosed two issues in deployments of the open-source mcp-gateway-registry. CVE-2026-100307 (GHSA-rxf3-qgpv-wxvr) affects 1.0.9 through 1.24.7. An authenticated low-privileged caller can use the management API to map an identity-provider group to a privileged scope. Version 1.25.0 enforces authorization when these endpoints write changes. Existing mappings remain active until reviewed and removed, and the upgrade does not invalidate any credentials already read.

CVE-2026-125926 (GHSA-fc39-fwh3-wv5r) affects 1.0.3 through 1.34.0. An authenticated user who can register or change a server can point its upstream address at services reachable from the gateway. Depending on network configuration and response handling, the path can expose internal data or cloud metadata credentials. Version 1.35.0 validates new or changed addresses and leaves existing configuration in place. Upgrade, audit historical state and confirm that management routes and outbound connections are restricted.

What’s in the bowl

CVE-2026-100307

External management API lacks authorization

Authenticated low-privileged callers can create a group mapping that gives their identity registry administrator access.

CVE-2026-125926

Server registration can send internal requests

An authenticated caller with server registration or modification rights can send requests to internal destinations and may read the responses.

Fixed versions

Product	Safe from	Note
mcp-gateway-registry (both CVEs)	`1.35.0`

Crime-scene timeline

Nov 11, 20:30 UTC
AWS discloses management API privilege escalation
The advisory identifies 1.25.0 as the first fix and calls for an audit of existing grants and credentials.
Nov 11, 21:00 UTC
AWS discloses a separate server-side request forgery flaw
The advisory identifies 1.35.0 as the first fix and calls for a review of stored upstream URLs.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

AWS bulletin 2026-179-AWSPrimaryAffected versions, authorization requirements and persistent grants to audit for CVE-2026-100307.
AWS bulletin 2026-180-AWSPrimaryAffected versions, registration permissions and stored-address review for CVE-2026-125926.
Maintainer advisory GHSA-fc39-fwh3-wv5rPrimaryConfirms the fixed version and explains the conditional path to cloud metadata and credentials.

Wipe guide

The wipe checklist

0 of 3 sheets used

Upgrade and restrict the APIUpgrade mcp-gateway-registry and affected forks to 1.35.0 or later. Until patched, restrict /api/servers/* mutation routes to trusted administrators and limit server registration and updates to trusted users. Restrict registry and auth-server egress to required destinations. On EC2 require IMDSv2 and minimize attached IAM permissions.
Remove unauthorized grantsIn the mcp_scopes DocumentDB collection, review group_mappings for mcp-registry-admin and other privileged scopes, and ui_permissions for mutation rights granted to all users. Remove unexpected grants. In HTTP logs review POST /api/servers/groups/import plus the create, add, remove and delete group routes and other server-mutation endpoints. Correlate with subsequent activity by the same identity.
Audit stored server addresses and credentialsCompare registered servers and agents with a trusted inventory, including existing upstream URLs, and correct or remove unexpected settings. Review registration and update logs from the affected period. Rotate stored server credentials and sensitive headers at their source if unauthorized reads cannot be ruled out. If an attached cloud role may have been exposed, review its activity and replace or revoke exposed credentials or sessions as applicable.