Threat video1:00
CVE-2026-125926 mcp-gateway-registry SSRF: Detection & IOCs
Authenticated users can steer mcp-gateway-registry at internal services and cloud metadata. Hunt with 9 detection rules, 13 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-125926: SSRF in mcp-gateway-registry (v1.0.3-v1.34.0)… →
Chapters
- 0:00The hookAWS rated it Important: CVSS 8.5.
- 0:05The storyAuthenticated users could point upstream addresses internally.
- 0:11Attack pathRegister-rights users, according to AWS.
- 0:29AttributionNo threat actor: this was defensive research.
- 0:33Indicators of compromise10 indicators to hunt: 2 IPs, 5 URLs and 1 file name, and more.
- 0:39MITRE ATT&CK techniques6 ATT&CK techniques, from initial access to command and control.
- 0:44Remediation11 remediation steps are listed, 4 of them immediate.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00AWS rated it Important: CVSS 8.5.
0:05Authenticated users could point upstream addresses internally.
0:09Cloud metadata can be reachable.
0:12Register-rights users, according to AWS.
0:15The API did not validate upstream addresses.
0:19The gateway sent requests on their behalf.
0:21Issued credentials can be reachable.
0:24Upgrade to 1.35.0; review upstream addresses.
0:30No threat actor: this was defensive research.
0:3410 indicators to hunt: 2 IPs, 5 URLs and 1 file name, and more.
0:406 ATT&CK techniques, from initial access to command and control.
0:4511 remediation steps are listed, 4 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.