What happened
The registry validates a registered server's upstream address without blocking internal/private destinations, so an authenticated user can register a server pointing at an internal service or metadata endpoint. The gateway then issues requests to that address and can return the responses to the caller.
Why it matters
In an MCP deployment the registry fronts all agent tool traffic. SSRF here lets a low-privilege MCP user pivot to internal network services and cloud metadata, extending the reach of an agent-driven attack.
Attack vector
An authenticated user permitted to register/modify a server sets an upstream address that causes the gateway to send requests to services on the deployment's internal network (including cloud instance metadata endpoints), and in some cases the response is returned to the user.
Affected systems
Amazon mcp-gateway-registry >= v1.0.3 AND <= 1.34.0
Mitigation
Upgrade to mcp-gateway-registry 1.35.0 (validates upstream addresses). Interim: restrict server register/modify permissions to trusted accounts; constrain outbound network access from registry/auth-server components; require IMDSv2 and grant only needed role permissions. After upgrade, review registered upstream addresses and logs for unexpected registrations/changes.