AWS patches MCP gateway vulnerability that opens internal services

On 11 November 2026, AWS wrote a bulletin on CVE-2026-125926, a vulnerability in mcp-gateway-registry. This open-source tool records MCP servers, controls access to them and sends messages to them. MCP (Model Context Protocol) is a standard that lets AI agents use external tools. A user who can add or change a server could make the gateway send messages to services on the internal network of the deployment.

How it works

The vulnerability is a server-side request forgery. The registry did not check the upstream address of a server. A user with permission to add or change a server could set an address on the internal network. In some conditions, the gateway sent the responses to the user.

The proof

AWS marks the bulletin Important. It gives no severity score and no report of attacks. An external researcher, novice-22, helped AWS on the problem through coordinated disclosure.

What stays open

Version 1.35.0 does not change servers that you set before the upgrade. After the upgrade, teams must examine these items:

• Upstream addresses of servers: remove each address that is incorrect.
• Logs from the time that a version with the vulnerability was in use: look for changes that you did not make.
• The cloud role of the registry: if logs do not show that all is correct, examine its work and replace its credentials.

Insight: Each layer of MCP software has had a vulnerability

Since October, vulnerabilities have come out in the MCP software kits and in MCP Inspector. At this time, the gateway has one. The gateway is between AI tools and internal services. Each layer of MCP software has had a vulnerability. The gateway gets the most access and is possibly the layer to patch first. Patches for MCP must include all layers, not only the kits.