# CVE-2026-125926: SSRF in mcp-gateway-registry (v1.0.3-v1.34.0) Exposes Internal Network Services and Cloud Metadata (AWS Bulletin 2026-180-AWS)

> AWS and the GitHub advisory GHSA-fc39-fwh3-wv5r disclose a server-side request forgery (CWE-918) in the open-source mcp-gateway-registry, affecting v1.0.3 through v1.34.0. An authenticated user with permission to register or modify a server can point its upstream address at internal services, including the cloud instance metadata service and the credentials it issues. Fixed in 1.35.0.

- **Published:** 2026-11-13T05:19:42Z
- **Last reviewed:** 2026-11-13T05:19:42Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5928
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5928.png
- **ID:** TL-2026-5928
- **Severity:** HIGH (CVSS 8.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (1 shown free below)
- **CVEs:** CVE-2026-125926

## Description

mcp-gateway-registry is an open-source registry and gateway for Model Context Protocol (MCP) servers (GitHub: agentic-community/mcp-gateway-registry). Its server registration and update API did not validate the upstream address supplied for a registered server. An authenticated user holding permission to register or modify servers could therefore set that address to a service on the deployment's internal network, causing the gateway to send requests on their behalf. In some cases the gateway returned the upstream response to the requesting user, turning the blind SSRF into a read primitive.

In cloud deployments the reachable internal targets can include the instance metadata service (IMDS) and the temporary credentials it issues to the attached cloud role. AWS therefore recommends that operators who cannot rule out unexpected activity review the attached role's activity and rotate its credentials. The GitHub advisory scores the issue CVSS 3.1 8.5 (High) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N; AWS rates the bulletin 'Important'. CVE-2026-125926 was reported by the researcher with the handle novice-22 via coordinated disclosure.

Affected versions are v1.0.3 through 1.34.0 inclusive; the fix shipped in 1.35.0 (GitHub release dated 29 October 2026), and the AWS bulletin and GitHub advisory were published 11 November 2026. The fix validates upstream addresses on registration and modification but does NOT alter server configurations stored before the upgrade, so operators must review existing registered upstream addresses and logs for unexpected registrations or changes. A separate, unrelated issue in the external management API was fixed in 1.25.0; deployments on 1.25.0 or later remain affected by this CVE until they reach 1.35.0. Helm installs with bundled Keycloak have a breaking change in 1.35.0 (the keycloak-client-secret Secret must be adopted before upgrading). Forked or derivative code must incorporate the fix.

No public proof-of-concept and no in-the-wild exploitation of this CVE are stated in the sources reviewed, and no network IOCs have been published. The exact endpoint path and fix commit are not identified in the advisory. Interim workarounds: limit register/modify permissions to trusted accounts, restrict outbound network access from the registry and auth-server components to required destinations, and on Amazon EC2 require IMDSv2 and grant each component's role only the permissions it needs.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1090 Proxy
- T1046 Network Service Discovery
- T1552.005 Cloud Instance Metadata API
- T1078.004 Cloud Accounts
- T1078 Valid Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**mcp-gateway-registry CVE-2026-125926 SSRF — Server Registered/Modified With Loopback, Link-Local or IMDS (169.254.169.254) Upstream** (`TL-2026-5928-SPL-001`)

Detects the core exploitation behaviour of CVE-2026-125926 (GHSA-fc39-fwh3-wv5r, AWS-2026-180-AWS, CWE-918) in mcp-gateway-registry v1.0.3-v1.34.0: an authenticated user calls the server register/update API and sets the upstream address to the AWS instance metadata service (169.254.169.254 / fd00:ec2::254), loopback or another link-local target so the gateway issues requests on their behalf and may return IAM role credentials. High-fidelity classes only (loopback, link-local/IMDS, 0.0.0.0, localhost, decimal/hex-encoded IPs, nip/sslip/xip wildcard DNS); RFC1918 targets are covered by TL-2026-5928-SPL-003. The advisory does not name the exact endpoint path, so the /servers and /register path filter is an assumption to tune. No public PoC or in-the-wild exploitation is reported (TL-2026-5928, T1190, T1078).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1078
- **Data sources:** mcp-gateway-registry application logs (index=mcp_gateway), Splunk sourcetype mcp-gateway-registry:app, Azure Monitor ContainerLogV2
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=mcp_gateway sourcetype="mcp-gateway-registry:app" earliest=-24h (POST OR PUT OR PATCH) ("/servers" OR "/register")
| eval upstream_url=replace(_raw, "(?is).*?(?:proxy_pass_url|upstream\w*|server_url|endpoint|url)\x22?\s*[:=]\s*\x22?(https?://[^\x22\s,}]+).*", "\1")
| where match(upstream_url, "^https?://[^\x22\s,}]+$")
| eval upstream_host=replace(upstream_url, "^https?://(\x5b[^\x5d]+\x5d|[^/:?#]+).*", "\1")
| eval actor=coalesce(user, username, src_user, "unknown")
| where match(upstream_host, "(?i)^(127\.|169\.254\.|0\.0\.0\.0$|localhost$|0x[0-9a-f]+$|\d{8,10}$|instance-data|metadata\.google\.internal$|\x5b(::1|fd00:ec2::254|fe80:[^\x5d]*)\x5d$|.*\.(nip|sslip|xip)\.io$)")
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(upstream_url) as upstream_urls values(src_ip) as src_ips by actor host
| convert ctime(first_seen) ctime(last_seen)
| sort - count
```

### Microsoft KQL

```kql
ContainerLogV2
| where TimeGenerated > ago(24h)
| where ContainerName has_any ("registry", "mcp-gateway")
| where LogMessage has_any ("POST", "PUT", "PATCH") and LogMessage has_any ("/servers", "/register")
| extend UpstreamUrl = extract(@'(?i)(?:proxy_pass_url|upstream\w*|server_url|endpoint|url)"?\s*[:=]\s*"?(https?://[^"\s,}]+)', 1, LogMessage)
| where isnotempty(UpstreamUrl)
| extend UpstreamHost = tolower(extract(@'^https?://(\x5b[^\x5d]+\x5d|[^/:?#]+)', 1, UpstreamUrl))
| extend ActorRaw = extract(@'(?i)(?:user|username|actor|client_id)"?\s*[:=]\s*"?([A-Za-z0-9_.@-]+)', 1, LogMessage)
| extend Actor = iff(isempty(ActorRaw), "unknown", ActorRaw)
| where UpstreamHost matches regex @'^(127\.|169\.254\.|0\.0\.0\.0$|localhost$|0x[0-9a-f]+$|\d{8,10}$|instance-data|metadata\.google\.internal$|\x5b(::1|fd00:ec2::254|fe80:[^\x5d]*)\x5d$|.*\.(nip|sslip|xip)\.io$)'
| project TimeGenerated, Computer, PodName, ContainerName, Actor, UpstreamUrl, UpstreamHost, LogMessage
```

### Sigma

```yaml
title: mcp-gateway-registry SSRF - Server Registered With Loopback/Link-Local/IMDS Upstream (CVE-2026-125926)
id: 3b1f6a52-7c0e-4d8a-9e21-5a4c8d7f1b01
status: experimental
description: Detects registration or modification of an MCP server whose upstream address (proxy_pass_url) points to loopback, link-local, the AWS instance metadata service or an encoded/wildcard-DNS equivalent, the exploitation behaviour of CVE-2026-125926 in mcp-gateway-registry 1.0.3-1.34.0. Field names follow the registry application log; map request_path/proxy_pass_url to your pipeline.
references:
  - https://aws.amazon.com/security/security-bulletins/2026-180-aws/
  - https://github.com/agentic-community/mcp-gateway-registry/security/advisories/GHSA-fc39-fwh3-wv5r
author: Threadlinqs Team
date: 2026-11-13
tags:
  - attack.initial-access
  - attack.t1190
  - attack.t1078
  - cve.2026.125926
logsource:
  category: application
  product: mcp_gateway_registry
detection:
  selection_path:
    request_path|contains:
      - '/servers'
      - '/register'
  selection_upstream:
    proxy_pass_url|re:
      - '(?i)^https?://(127\.|169\.254\.|0\.0\.0\.0|localhost|instance-data|metadata\.google\.internal|\[(::1|fd00:ec2::254|fe80:))'
      - '(?i)^https?://(0x[0-9a-f]+|[0-9]{8,10})([:/?#]|$)'
      - '(?i)^https?://[^/]*\.(nip|sslip|xip)\.io([:/?#]|$)'
  condition: selection_path and selection_upstream
falsepositives:
  - Developers registering a local test MCP server on localhost or 127.0.0.1 in a non-production registry
  - Sidecar-style MCP servers legitimately reached over loopback
level: high

```

**Known false positives:**

- Developers registering a local test MCP server on localhost/127.0.0.1 in a non-production registry
- Sidecar MCP servers legitimately reached over loopback or a link-local address

**Tuning notes:** Confirm the real field/path names in your registry logs (advisory does not name the endpoint) and adjust the replace() extraction and the /servers|/register filter. Allowlist known localhost sidecar registrations by actor + upstream_url. Scope to production registries and to affected versions 1.0.3-1.34.0; after upgrading to 1.35.0 the same hits indicate pre-upgrade stored configs or attempted bypass.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- [indicator] — Rapid Upstream Address Rotation by a Single Account (CVE-2026-125926 SSRF Probing) (locked: unlock with TL Creds)
- [indicator] Process Network Connection to IMDS ([indicator] / [indicator]) from Python/Uvicorn/Gunicorn/nginx (locked: unlock with TL Creds)
- Registry Host Process Fan-Out to Many Internal IPs/Ports — Internal Service Discovery via Gateway Proxy (CVE-2026-125926) (locked: unlock with TL Creds)
- Web Access Log — [indicator] Server API Request Carrying Internal/IMDS Address (CVE-2026-125926) (locked: unlock with TL Creds)
- AWS Instance Role Credentials Used From Multiple Source IPs — Possible IMDS Credential Theft via [indicator] (locked: unlock with TL Creds)
- Stolen EC2 Instance Role Credentials — Discovery API Calls From Non-AWS Source (Post-SSRF IMDS Theft, CVE-2026-125926) (locked: unlock with TL Creds)
- [indicator] Gateway Proxying to AWS IMDS ([indicator] / [indicator]) — Cloud Credential Exposure (CVE-2026-125926) (locked: unlock with TL Creds)
- [indicator] Used as Internal Proxy — One Account Targeting 5+ Distinct Internal host:port Upstreams (CVE-2026-125926) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 13)

Defanged, TLP:CLEAR.

- URL: `hxxps://aws[.]amazon[.]com/security/security-bulletins/2026-180-aws/`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [AWS Security Bulletin 2026-180-AWS (CVE-2026-125926)](https://aws.amazon.com/security/security-bulletins/2026-180-aws/)
- [GitHub Advisory GHSA-fc39-fwh3-wv5r: SSRF in server registration/update API](https://github.com/agentic-community/mcp-gateway-registry/security/advisories/GHSA-fc39-fwh3-wv5r)
- [mcp-gateway-registry release 1.35.0](https://github.com/agentic-community/mcp-gateway-registry/releases/tag/1.35.0)
- [CVE Record CVE-2026-125926](https://www.cve.org/CVERecord?id=CVE-2026-125926)
- [AWS Warns of MCP Gateway Registry Vulnerability Allowing Attackers to Access Internal Network Services (GBHackers)](https://gbhackers.com/aws-warns-of-mcp-gateway-registry-vulnerability/)
- [mcp-gateway-registry repository](https://github.com/agentic-community/mcp-gateway-registry)
- [AWS EC2 documentation: Configure the Instance Metadata Service (IMDSv2)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html)
- [CWE-918: Server-Side Request Forgery (SSRF)](https://cwe.mitre.org/data/definitions/918.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5928