[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYz_HuyStNrh-X8meyJVV1bYqkQTri0719gzGftfhKME":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"699e8384-ac88-467d-9a1d-e2132e445087","ssrf-flaw-in-aws-mcp-gateway-exposed-internal-networks-and-cloud-credentials","96b9ac9f-a08a-4483-9b91-f697fbbdd42c","SSRF Flaw in AWS MCP Gateway Exposed Internal Networks and Cloud Credentials","A server-side request forgery (SSRF) vulnerability in AWS's mcp-gateway-registry allowed authenticated users to coerce the gateway into making internal requests on their behalf, potentially reaching cloud metadata services and harvesting attached IAM role credentials. This is a classic SSRF risk that is amplified in cloud environments where instance metadata endpoints (e.g., IMDSv1) can expose powerful credentials without additional authentication. The vulnerability persisted across a wide version range (1.0.3–1.34.0), indicating that SSRF protections were not part of the original design or review process. The incident underscores how a single unvalidated outbound request path in an internet-facing service can pivot into full cloud account compromise if roles are over-permissioned or metadata protections are absent.","**Immediate actions:**\n- Upgrade all mcp-gateway-registry deployments to version 1.35.0 or later immediately.\n- Audit IAM roles attached to the gateway service and restrict permissions to the minimum required.\n- Enable IMDSv2 (token-required mode) on all EC2 instances to limit metadata endpoint exposure via SSRF.\n\n**Long-term improvements:**\n- Integrate SSRF-specific testing (e.g., blind SSRF probes against internal endpoints) into the SDLC for all internet-facing services.\n- Enforce allowlist-based egress controls on gateway components so they can only reach explicitly approved destinations.\n- Apply the principle of least privilege to all cloud roles and rotate credentials on a scheduled basis.\n\n**Detection measures:**\n- Monitor outbound requests from gateway services for unexpected destinations such as 169.254.169.254 or internal RFC-1918 addresses.\n- Alert on any retrieval of cloud credentials or IAM token requests originating from the gateway process.\n- Review gateway access logs regularly for authenticated users making unusual or high-volume internal requests.",[12,13,14,15,16],"OWASP A10:2021 Server-Side Request Forgery","CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-10: Information Input Validation","NIST SP 800-53 AC-6: Least Privilege","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 AC-6: Least Privilege":19,"OWASP A10:2021 Server-Side Request Forgery":20,"NIST SP 800-53 SI-10: Information Input Validation":21,"CIS Control 7: Continuous Vulnerability Management (v8)":22},"This point requires security in acquisition, development and maintenance including vulnerability handling; embedding SSRF testing during development and promptly disclosing and patching the flaw aligns with what this article demands.","AC-6 mandates that cloud roles and service accounts hold only the permissions necessary for their function; limiting the gateway's attached role would have reduced the blast radius if credentials were accessed.","This control directly covers SSRF vulnerabilities where an application fetches remote resources without validating the user-supplied URL, which is exactly the mechanism exploited here.","SI-10 requires that systems validate all inputs before processing; enforcing strict allowlist validation on URLs the gateway is permitted to request would have prevented the SSRF exploitation.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities in software; timely discovery and patching of CVE-2026-125926 across the affected version range would have been mandated by this control.","published","2026-11-12T14:21:00.259978+00:00","2026-11-12T14:21:00.195+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcybersecuritynews.com\u002Faws-mcp-gateway-security-flaw\u002F","aws-mcp-gateway-security-flaw-allowing-access-to-internal-networks-and-cloud-cre-c2ad66","AWS MCP Gateway Security Flaw Allowing Access to Internal Networks and Cloud Credentials",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,49,52],{"slug":46,"name":47,"problem":48},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":40,"name":50,"problem":51},"Automated patch management","Known holes get closed in days, not months.",{"slug":53,"name":54,"problem":55},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak."]