Description
Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request.
To remediate this issue, users should upgrade to version 1.35.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AWS | mcp-gateway-registry | 1.0.3 – ≤ 1.34.0 | — |