CVE-2026-125926
HIGH
NVD
CVSS Score
8.5
Severity
HIGH
Published
Nov 11, 2026
Vendor
unknown
Description
Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request. To remediate this issue, users should upgrade to version 1.35.0.