What is 2026-180-AWS?

2026-180-AWS is a security advisory published by AWS Security Bulletins. CVE-2026-125926 - Server-side request forgery in the server registration and update API in mcp-gateway-registry

Which CVE IDs does 2026-180-AWS cover?

2026-180-AWS covers the following CVE IDs: CVE-2026-125926. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

2026-180-AWS

CVE-2026-125926 - Server-side request forgery in the server registration and update API in mcp-gateway-registry

Vendor

AWS Security Bulletins

Published

November 11, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-125926 →

📋 Description

Bulletin ID: 2026-180-AWS Publication Date: 11/11/2026 13:00 PM PST Description: MServer-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request Impacted versions: >= v1.0.3 AND
Refer to the article for the most up-to-date and complete information.

🔗 References (1)

advisoryhttps://aws.amazon.com/security/security-bulletins/rss/2026-180-aws/