mcp-gateway-registry vulnerabilities

2 known vulnerabilities in mcp-gateway-registry from AWS. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.5 High severity

  mcp-gateway-registry: Server-Side Request Forgery

  CVE-2026-125926Nov 11, 2026AWS

  Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoi

• 8.8 High severity

  mcp-gateway-registry: Incorrect Privilege Assignment

  CVE-2026-100307Nov 11, 2026AWS

  Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every