{"id":"CVE-2026-125926","summary":"Server-side request forgery in the server registration and update API in mcp-gateway-registry","details":"Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request.\n\n\n\nTo remediate this issue, users should upgrade to version 1.35.0.","modified":"2026-11-13T02:47:10.523149327Z","published":"2026-11-11T20:50:28.168Z","database_specific":{"cna_assigner":"AMZN","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125926.json"},"references":[{"type":"ADVISORY","url":"https://aws.amazon.com/security/security-bulletins/2026-180-aws/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125926.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125926"},{"type":"FIX","url":"https://github.com/agentic-community/mcp-gateway-registry/releases/tag/1.35.0"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/agentic-community/mcp-gateway-registry","events":[{"introduced":"f9a3e70d7dabdae0fcb31e2387230cfa3ba21dc0"},{"fixed":"977bb924e3402b1078fa2e6581b5babead899a95"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"1.0.3"},{"last_affected":"1.34.0"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"original_tag":"1.35.0","range":[{"fixed":"977bb924e3402b1078fa2e6581b5babead899a95"}],"source":"REFERENCES_TAG"}]}}],"versions":["1.34.0","1.33.0","1.32.1","1.32.0","1.31.0","1.30.0","1.29.0","1.28.0","1.27.1","1.27.0","1.26.0","1.25.0","1.24.7","1.24.6","1.24.5","1.24.4","1.24.3","1.24.2","1.24.1","1.24.0","1.23.0","v1.0.22-p1","v1.0.22","v1.0.21","v1.0.20","v1.0.19","v1.0.18","v1.0.17","v1.0.16","v1.0.15","v1.0.13","v1.0.12","v1.0.11","v1.0.10","v1.0.9-patch1","v1.0.8","v1.0.9","v1.0.7","v1.0.6","v1.0.5","v1.0.4","v1.0.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-125926.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N"}]}