MCP Gateway Registry let server registrants request internal URLs

A different MCP Gateway Registry flaw accepted a server registrant-controlled upstream URL and could issue network requests to destinations that should have remained private. In some configurations the upstream response could return through the registry.

An authenticated registrant and a reachable internal destination are prerequisites. EC2 metadata exposure would require a compatible network route and metadata protections; an arbitrary URL is not proof that role credentials can be read. The 1.35.0 repair validates newly registered or changed destinations, but a security review also has to examine previously registered upstream addresses that remain in storage.

The advisory for CVE-2026-125926 does not document live metadata theft, a customer compromise or exploitation of the separate group-import authorization issue. Patch the registry, audit retained upstream destinations, and restrict egress independently of URL validation.

Evidence reconciliation and effect boundary. A registrant with legitimate permission to add an MCP server should not thereby obtain the gateway’s network access to unrelated internal services. The unsafe address was used by the registry as an upstream request destination, and in some configurations the response could be sent back to the registrant. Cloud instance-metadata exposure depends on network controls and reachable services; the advisory does not confirm actual credential theft. A deployment may need to inspect old registrations as well as update its binary.