Bulletin ID: 2026-180-AWS
Publication Date: 11/11/2026 13:00 PM PST
Description:
MServer-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request
Impacted versions: >= v1.0.3 AND <= 1.34.0
Refer to the article for the most up-to-date and complete information.
This article has been indexed from Latest Bulletins