CVE-2026-125926: SSRF in mcp-gateway-registry (v1.0.3-v1.34.0) Exposes Internal Network Services and Cloud Metadata (AWS Bulletin 2026-180-AWS)

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5928 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: mcp-gateway-registry CVE-2026-125926 SSRF — Server Registered/Modified With Loopback, Link-Local or IMDS (169.254.169.254) Upstream

Detects the core exploitation behaviour of CVE-2026-125926 (GHSA-fc39-fwh3-wv5r, AWS-2026-180-AWS, CWE-918) in mcp-gateway-registry v1.0.3-v1.34.0: an authenticated user calls the server register/update API and sets the upstream address to the AWS instance metadata service (169.254.169.254 / fd00:ec2::254), loopback or another link-local target so the gateway issues requests on their behalf and may return IAM role credentials. High-fidelity classes only (loopback, link-local/IMDS, 0.0.0.0, localhost, decimal/hex-encoded IPs, nip/sslip/xip wildcard DNS); RFC1918 targets are covered by TL-2026-5928-SPL-003. The advisory does not name the exact endpoint path, so the /servers and /register path filter is an assumption to tune. No public PoC or in-the-wild exploitation is reported (TL-2026-5928, T1190, T1078).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1078
• Data sources: mcp-gateway-registry application logs (index=mcp_gateway), Splunk sourcetype mcp-gateway-registry:app, Azure Monitor ContainerLogV2
• Severity: high
• Confidence: high

Splunk SPL

index=mcp_gateway sourcetype="mcp-gateway-registry:app" earliest=-24h (POST OR PUT OR PATCH) ("/servers" OR "/register")
| eval upstream_url=replace(_raw, "(?is).*?(?:proxy_pass_url|upstream\w*|server_url|endpoint|url)\x22?\s*[:=]\s*\x22?(https?://[^\x22\s,}]+).*", "\1")
| where match(upstream_url, "^https?://[^\x22\s,}]+$")
| eval upstream_host=replace(upstream_url, "^https?://(\x5b[^\x5d]+\x5d|[^/:?#]+).*", "\1")
| eval actor=coalesce(user, username, src_user, "unknown")
| where match(upstream_host, "(?i)^(127\.|169\.254\.|0\.0\.0\.0$|localhost$|0x[0-9a-f]+$|\d{8,10}$|instance-data|metadata\.google\.internal$|\x5b(::1|fd00:ec2::254|fe80:[^\x5d]*)\x5d$|.*\.(nip|sslip|xip)\.io$)")
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(upstream_url) as upstream_urls values(src_ip) as src_ips by actor host
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Microsoft KQL

ContainerLogV2
| where TimeGenerated > ago(24h)
| where ContainerName has_any ("registry", "mcp-gateway")
| where LogMessage has_any ("POST", "PUT", "PATCH") and LogMessage has_any ("/servers", "/register")
| extend UpstreamUrl = extract(@'(?i)(?:proxy_pass_url|upstream\w*|server_url|endpoint|url)"?\s*[:=]\s*"?(https?://[^"\s,}]+)', 1, LogMessage)
| where isnotempty(UpstreamUrl)
| extend UpstreamHost = tolower(extract(@'^https?://(\x5b[^\x5d]+\x5d|[^/:?#]+)', 1, UpstreamUrl))
| extend ActorRaw = extract(@'(?i)(?:user|username|actor|client_id)"?\s*[:=]\s*"?([A-Za-z0-9_.@-]+)', 1, LogMessage)
| extend Actor = iff(isempty(ActorRaw), "unknown", ActorRaw)
| where UpstreamHost matches regex @'^(127\.|169\.254\.|0\.0\.0\.0$|localhost$|0x[0-9a-f]+$|\d{8,10}$|instance-data|metadata\.google\.internal$|\x5b(::1|fd00:ec2::254|fe80:[^\x5d]*)\x5d$|.*\.(nip|sslip|xip)\.io$)'
| project TimeGenerated, Computer, PodName, ContainerName, Actor, UpstreamUrl, UpstreamHost, LogMessage

Sigma

title: mcp-gateway-registry SSRF - Server Registered With Loopback/Link-Local/IMDS Upstream (CVE-2026-125926)
id: 3b1f6a52-7c0e-4d8a-9e21-5a4c8d7f1b01
status: experimental
description: Detects registration or modification of an MCP server whose upstream address (proxy_pass_url) points to loopback, link-local, the AWS instance metadata service or an encoded/wildcard-DNS equivalent, the exploitation behaviour of CVE-2026-125926 in mcp-gateway-registry 1.0.3-1.34.0. Field names follow the registry application log; map request_path/proxy_pass_url to your pipeline.
references:
  - https://aws.amazon.com/security/security-bulletins/2026-180-aws/
  - https://github.com/agentic-community/mcp-gateway-registry/security/advisories/GHSA-fc39-fwh3-wv5r
author: Threadlinqs Team
date: 2026-11-13
tags:
  - attack.initial-access
  - attack.t1190
  - attack.t1078
  - cve.2026.125926
logsource:
  category: application
  product: mcp_gateway_registry
detection:
  selection_path:
    request_path|contains:
      - '/servers'
      - '/register'
  selection_upstream:
    proxy_pass_url|re:
      - '(?i)^https?://(127\.|169\.254\.|0\.0\.0\.0|localhost|instance-data|metadata\.google\.internal|\[(::1|fd00:ec2::254|fe80:))'
      - '(?i)^https?://(0x[0-9a-f]+|[0-9]{8,10})([:/?#]|$)'
      - '(?i)^https?://[^/]*\.(nip|sslip|xip)\.io([:/?#]|$)'
  condition: selection_path and selection_upstream
falsepositives:
  - Developers registering a local test MCP server on localhost or 127.0.0.1 in a non-production registry
  - Sidecar-style MCP servers legitimately reached over loopback
level: high

Known false positives:

• Developers registering a local test MCP server on localhost/127.0.0.1 in a non-production registry
• Sidecar MCP servers legitimately reached over loopback or a link-local address

Tuning notes: Confirm the real field/path names in your registry logs (advisory does not name the endpoint) and adjust the replace() extraction and the /servers|/register filter. Allowlist known localhost sidecar registrations by actor + upstream_url. Scope to production registries and to affected versions 1.0.3-1.34.0; after upgrading to 1.35.0 the same hits indicate pre-upgrade stored configs or attempted bypass.

• 🔒 [indicator] — Rapid Upstream Address Rotation by a Single Account (CVE-2026-125926 SSRF Probing) · unlock with TL Creds
• 🔒 [indicator] Process Network Connection to IMDS ([indicator] / [indicator]) from Python/Uvicorn/Gunicorn/nginx · unlock with TL Creds
• 🔒 Registry Host Process Fan-Out to Many Internal IPs/Ports — Internal Service Discovery via Gateway Proxy (CVE-2026-125926) · unlock with TL Creds
• 🔒 Web Access Log — [indicator] Server API Request Carrying Internal/IMDS Address (CVE-2026-125926) · unlock with TL Creds
• 🔒 AWS Instance Role Credentials Used From Multiple Source IPs — Possible IMDS Credential Theft via [indicator] · unlock with TL Creds
• 🔒 Stolen EC2 Instance Role Credentials — Discovery API Calls From Non-AWS Source (Post-SSRF IMDS Theft, CVE-2026-125926) · unlock with TL Creds
• 🔒 [indicator] Gateway Proxying to AWS IMDS ([indicator] / [indicator]) — Cloud Credential Exposure (CVE-2026-125926) · unlock with TL Creds
• 🔒 [indicator] Used as Internal Proxy — One Account Targeting 5+ Distinct Internal host:port Upstreams (CVE-2026-125926) · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5928.

Sample indicators (1 of 13)

• URL: hxxps://aws[.]amazon[.]com/security/security-bulletins/2026-180-aws/

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

Technical analysis

Fixed in 1.35.0.

mcp-gateway-registry is an open-source registry and gateway for Model Context Protocol (MCP) servers (GitHub: agentic-community/mcp-gateway-registry). Its server registration and update API did not validate the upstream address supplied for a registered server. An authenticated user holding permission to register or modify servers could therefore set that address to a service on the deployment's internal network, causing the gateway to send requests on their behalf. In some cases the gateway returned the upstream response to the requesting user, turning the blind SSRF into a read primitive.

In cloud deployments the reachable internal targets can include the instance metadata service (IMDS) and the temporary credentials it issues to the attached cloud role. AWS therefore recommends that operators who cannot rule out unexpected activity review the attached role's activity and rotate its credentials. The GitHub advisory scores the issue CVSS 3.1 8.5 (High) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N; AWS rates the bulletin 'Important'. CVE-2026-125926 was reported by the researcher with the handle novice-22 via coordinated disclosure.

Affected versions are v1.0.3 through 1.34.0 inclusive; the fix shipped in 1.35.0 (GitHub release dated 29 October 2026), and the AWS bulletin and GitHub advisory were published 11 November 2026. The fix validates upstream addresses on registration and modification but does NOT alter server configurations stored before the upgrade, so operators must review existing registered upstream addresses and logs for unexpected registrations or changes. A separate, unrelated issue in the external management API was fixed in 1.25.0; deployments on 1.25.0 or later remain affected by this CVE until they reach 1.35.0. Helm installs with bundled Keycloak have a breaking change in 1.35.0 (the keycloak-client-secret Secret must be adopted before upgrading). Forked or derivative code must incorporate the fix.

No public proof-of-concept and no in-the-wild exploitation of this CVE are stated in the sources reviewed, and no network IOCs have been published. The exact endpoint path and fix commit are not identified in the advisory. Interim workarounds: limit register/modify permissions to trusted accounts, restrict outbound network access from the registry and auth-server components to required destinations, and on Amazon EC2 require IMDSv2 and grant each component's role only the permissions it needs.

MITRE ATT&CK techniques by tactic:

Discovery

T1046 Network Service Discovery

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Persistence

T1078 Valid Accounts

Defense Evasion

T1078.004 Cloud Accounts

Command and Control

T1090 Proxy

Credential Access

T1552.005 Cloud Instance Metadata API

Remediation

Patches

• mcp-gateway-registry 1.35.0 (validates upstream addresses on registration and modification); Helm users with bundled Keycloak must adopt the keycloak-client-secret Secret before upgrading

Immediate actions

• Upgrade mcp-gateway-registry to 1.35.0 or later
• Review all registered servers' upstream addresses and correct or remove unintended ones (the upgrade does not clean up existing entries)
• Review logs from the period the affected version was deployed for unexpected server registrations or changes
• If the registry has an attached cloud role and log review cannot rule out unexpected activity, review that role's activity and rotate its credentials

Workarounds

• Limit server register/modify permissions to trusted accounts
• Restrict outbound network access from the registry and auth-server components to required destinations
• On Amazon EC2, require IMDSv2

Longer-term hardening

• Grant each registry and auth-server component's cloud role only the permissions it needs
• Ensure forked or derivative code includes the upstream fixes
• Alert on server registration/modification events whose upstream address is a private, loopback or link-local address

Affected and fixed versions

• agentic-community — mcp-gateway-registry
  Vulnerable versions: 1.0.3 through 1.34.0
  Fixed in: 1.35.0

Timeline

• 2026-10-29 1.35.0 ships breaking changes for upgraders from 1.34.0: Helm installs with bundled Keycloak must adopt the keycloak-client-secret Secret first, metadata writes are capped at 10 KB / 8 nesting levels, and AUTH_SERVER_NGINX_MARKER_SECRET now also guards the registry API token.
• 2026-10-29 The 1.35.0 release notes also list related hardening: the auth server requires the nginx marker before minting the registry API token (#1959), registrant metadata is bounded (#1943), reserved forwarding headers are no longer sent to virtual-server backends (#1795), and the Keycloak OBO exchange refuses tokens the gateway would accept (#1678).
• 2026-10-29 mcp-gateway-registry 1.35.0 is released on GitHub; the release adds validation of registered servers' upstream addresses on registration and modification (per the AWS bulletin and GitHub advisory).
• 2026-11-11 CVE-2026-125926 is published in the CVE record alongside the AWS bulletin and GitHub advisory; the bulletin lists the page at 13:00 PST and gives aws-security@amazon.com as contact.
• 2026-11-11 AWS publishes Security Bulletin 2026-180-AWS (rated Important) describing the SSRF in the server registration and update API and advising upgrade to 1.35.0, review of upstream addresses and logs, and credential rotation where warranted.
• 2026-11-11 GitHub advisory GHSA-fc39-fwh3-wv5r is published by maintainer aarora79 for CVE-2026-125926 (CVSS 3.1 8.5 High, CWE-918), crediting novice-22 as finder; affected range >= v1.0.3 and <= 1.34.0.
• 2026-11-13 Threat tracked by the Threadlinqs platform as TL-2026-5928 with status PATCHED.
• 2026-11-13 GBHackers notes attackers already pursue the MCP reconnaissance plus cloud-metadata SSRF path in separate research, and that AWS recently fixed similar SSRF/auth flaws in its Loom agent platform; neither is tied to this CVE.
• 2026-11-13 GBHackers on Security reports the AWS warning; the article reports no confirmed exploitation of this CVE and no public PoC.

Sources cited

• AWS Security Bulletin 2026-180-AWS (CVE-2026-125926) aws.amazon.com · Advisory · 2026-11-11
• CVE Record CVE-2026-125926 CVE Program · Advisory · 2026-11-11
• AWS EC2 documentation: Configure the Instance Metadata Service (IMDSv2) docs.aws.amazon.com · Vendor report
• CWE-918: Server-Side Request Forgery (SSRF) MITRE · Research
• GitHub Advisory GHSA-fc39-fwh3-wv5r: SSRF in server registration/update API GitHub · Code repository · 2026-11-11
• mcp-gateway-registry release 1.35.0 GitHub · Code repository · 2026-10-29
• mcp-gateway-registry repository GitHub · Code repository
• AWS Warns of MCP Gateway Registry Vulnerability Allowing Attackers to Access Internal Network Services (GBHackers) gbhackers.com · News · 2026-11-13

More in vulnerability

• PostgreSQL CVE-2026-6460: 22-Year-Old Composite Type Confusion Enables Authenticated RCE; 52 CVEs Fixed in 18.7/17.12/16.16/15.20/14.25
• Citrix NetScaler ADC and Gateway: 28 Vulnerabilities Patched (CTX697305), Including Critical CVE-2026-120868 in Default Configurations
• Forescout Vedere Labs: AI-assisted harness finds 66 new vulnerabilities across 10 legacy TCP/IP stacks used in OT/IoT (incl. Nucleus NET CVE-2026-89208, CVE-2026-102073..102076; Ethernut CVE-2026-120596)
• GitHub Security Lab Taskflow Agent identifies 24 Android app vulnerabilities (OsmAnd exported MapActivity location tracking, Wikipedia deeplink account takeover; CVE-2026-65993 to CVE-2026-65997)
• SignDrop – Windows CLFS/Defender Local Privilege Escalation Zero-Day with Public PoC (Nightmare Eclipse)

Previous and next in vulnerability

• CVE-2026-21660 - Hardcoded credentials in Johnson Controls Frick Controls Quantum HD industrial refrigeration controller Previous report
• Check Point Gaia/Mobile Access Exploitation (CVE-2026-109618, CVE-2026-109619, CVE-2026-123039) Leads to Root Access and destroy_v6 Wiper Deployment on VMware ESXi Next report