CVE-2026-125926 - Server-side request forgery in the server registration and update API in mcp-gateway-registry
CVE-2026-125926
Summary
Bulletin ID: 2026-179-AWS
Publication Date: 11/11/2026 12:30 PM PST
Description:
Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafted group import request.
Impacted versions: >= 1.0.9 AND <= 1.24.7
Refer to the article for the most up-to-date and complete information.
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.