CVE-2026-125926

Registered MCP servers could direct the gateway to private services

AWS · MCP Gateway Registry upstream registration

First documented disclosure · Review checkpoint

Summary

The registry accepted upstream addresses outside its intended network boundary. Private service responses could reach the caller, depending on network access.

Severity and exploitation evidence

Medium · 6.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The registry accepted upstream addresses outside its intended network boundary.

Conditions required

The caller could register or modify an MCP server.

Potential impact

Private service responses could reach the caller, depending on network access.

Affected versions and configurations

1.0.3 through 1.34.0.

Fix and mitigation status

1.35.0. The earlier 1.25.0 authorization fix addressed a separate issue.

Practical next steps

Upgrade, validate previously saved upstream addresses and review registration logs and cloud-role activity.

Operating lesson

Check the authority granted to the affected component against the operation a user expects.

Evidence and limits

The 1.35.0 fix applies when a server is registered or edited. Upgrading does not revalidate existing registrations. The CVE record was published on 2026-11-11.

Sources