SB2026072606 - Multiple vulnerabilities in MCP Gateway

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072606

SB2026072606 - Multiple vulnerabilities in MCP Gateway

Published: July 26, 2026

Security Bulletin ID SB2026072606
CSH Severity
High
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 17% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause the gateway to issue server-side requests to internal services and disclose sensitive information.

The vulnerability exists due to server-side request forgery in remote URL handling in clientpool.go GetClient, NewRemoteMCPClient, remote.go, and related catalog/fetch/import paths when processing a server definition with an attacker-controlled remote URL. A remote user can supply untrusted import, catalog, or registry content containing a crafted remote URL to cause the gateway to issue server-side requests to internal services and disclose sensitive information.

Exploitation requires that a server definition with an attacker-chosen remote URL is loaded from untrusted import, catalog, or registry content. The issue can reach internal addresses including link-local instance-metadata endpoints, and the advisory describes the SSRF as blind or partial.


2) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to path traversal in ResolveFile in workingset.go when processing a file:// server reference. A local user can supply a file:// reference to an arbitrary absolute host path to disclose sensitive information.

Only files that pass later content or extension validation are accepted as server definitions, which limits what data is reflected back.


3) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to missing authorization in tool aggregation across backend servers when resolving tool names from multiple aggregated servers without per-server scoping or collision checks. A local user can register a colliding tool name on an untrusted aggregated server to disclose sensitive information.

Exploitation requires the gateway to aggregate an untrusted server alongside a trusted one without a per-server tool-name prefix configured. Subsequent calls and their arguments may be silently dispatched to the shadowing server.


4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code on the host.

The vulnerability exists due to missing authorization in the dynamic management tools and container volume handling when supplying crafted configuration to dynamic tools. A remote user can provide a sensitive host path as a bind mount value to execute arbitrary code on the host.

Exploitation requires dynamic tools to be enabled and the gateway to have Docker API authority.


5) Improper Verification of Cryptographic Signature (CVE-ID: N/A)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper verification of cryptographic signature in image signature verification in pull.go when processing server definitions that reference container images. A remote attacker can supply a server definition referencing an attacker-influenced image to execute arbitrary code.

User interaction is required to load a server definition from an external catalog, registry, or shared profile.


6) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to gain unauthenticated access to proxied tools and act with the user's stored secrets and OAuth tokens.

The vulnerability exists due to missing authentication for critical function in the /sse and /mcp HTTP endpoints when running the gateway in container mode with an HTTP transport. A remote attacker can send requests without authentication to gain unauthenticated access to proxied tools and act with the user's stored secrets and OAuth tokens.

The issue occurs because the bearer-token authentication middleware is not installed in container mode, and requests without an Origin header are allowed.


Remediation

Install update from vendor's website.

References