mcp-gateway-registry v1.0.13: SSRF (CVE-918), SQLi, Info Disclosure Fix

Vulnerability Overview In version , the following security-related issues have been resolved: 1. SSRF Protection: SSRF protection was added to redirect validation (CVE-918). 2. SQL Injection Prevention: SQL injection was prevented in the metrics-service reservation subsystem. 3. Information Disclosure Fix: Information disclosure issues within exceptions were fixed. 4. Static Token Authentication: Static token authentication was added for the Registry API. Impact Scope SSRF Protection: Affects all API calls that utilize redirect functionality. SQL Injection Prevention: Affects the metrics-service reservation subsystem. Information Disclosure Fix: Affects all exception handling logic. Static Token Authentication: Affects the authentication mechanism for the Registry API. Remediation 1. SSRF Protection: - SSRF protection mechanisms have been implemented within the redirect logic to ensure the security of redirect target addresses. 2. SQL Injection Prevention: - All SQL queries in the metrics-service reservation subsystem are now parameterized to prevent SQL injection attacks. 3. Information Disclosure Fix: - Exception handling logic has been modified to ensure that sensitive data is not leaked through exception messages. 4. Static Token Authentication: - A static token authentication mechanism has been added to the Registry API to enhance API security. Related Pull Requests SSRF Protection: PR #453 SQL Injection Prevention: PR #451 Information Disclosure Fix: PR #453 Static Token Authentication: PR #420 Configuration Changes Federation Environment Variables: Audit Logging: Upgrade Instructions Docker Compose Deployment: 1. Pull the latest changes: 2. Rebuild and restart: Kubernetes/Helm Deployment: 1. Update chart values to support Entra ID and federation features (if required). 2. Apply changes: Contributors Thanks to the following contributors for their contributions to this release: Amit Arora (@aarora79) Omri Shiv (@omrishiv) Dheeraj Oruganty (@dheerajoruganty) Bren Whyte (@brenwhyte) Andreas Feldmann (@ndrsfe) Abhishek Singh Gaurav Rele kanghengliu Resources Documentation: - Federation Guide - Federation registry setup and operations - Audit Logging - Compliance and audit trail documentation - Agent Skills - Skill registry documentation - Server Versioning - MCP server version routing Support GitHub Issues GitHub Discussions Documentation Full Changelog v1.0.12 - v1.0.13 Change Details Update charts to use v1.0.12 image by @omrishiv in #388 Use kubectl by @omrishiv in #396 Feature: Centralized endpoint URL parsing utility for custom MCP endpoints by @ndrsfe in #382 Feature: Expose mcp_endpoint in API responses and React frontend by @aarora79 in #400 Feature: Bump lodash in frontend from 4.17.21 to 4.17.23 by @dependabot[bot] in #397 Feature: Add custom metadata fields for servers and agents by @aarora79 in #406 Feature: MCP server version routing by @aarora79 in #407 Feature: Bump filelock from 3.20.1 to 3.20.3 by @dependabot[bot] in #401 Feature: Bump pyasn1 from 0.6.1 to 0.6.2 by @dependabot[bot] in #402 Feature: Bump python-multipart from 0.0.21 to 0.0.22 by @dependabot[bot] in #403 Feature: Bump aiohttp from 3.13.2 to 3.13.3 by @dependabot[bot] in #404 Feature: Bump urllib3 from 2.6.2 to 2.6.3 by @dependabot[bot] in #405 Feature: Bump pyasn1 from 0.6.1 to 0.6.2 in agents/a2a by @dependabot[bot] in #377 Feature: Bump python-multipart from 0.0.20 to 0.0.22 in agents/a2a by @dependabot[bot] in #409 Feature: Bump aiohttp from 3.13.2 to 3.13.3 in agents/a2a by @dependabot[bot] in #411 Feature: Bump langchain-core from 1.2.4 to 1.2.5 by @dependabot[bot] in #410 Fix: Terraform - Immediate secret deletion recovery window, days = 0 on all Secrets Manager secrets by @brenwhyte in #385 Fix: Terraform - Add missing security group rule for MCPGW - registry communication by @brenwhyte in #393 Fix: Terraform - Module level depends_on - causing cascading resource recreation by @brenwhyte in #394 Feature: Bump mcp from 1.21.0 to 2.3.0 in agents/a2a by @dependabot[bot] in #412 Feature: Support subdomain and path-based routing by @omrishiv in #395 Feature: Add Docker Hardened Image (DHI) support as optional override by @aarora79 in #414 Feature: Add lexical fallback when embedding models are unavailable by @aarora79 in #415 Feature: Dynamically generate shared secretKey by @omrishiv in #417 Feature: Add static token authentication for Registry API by @aarora79 in #420 Feature: Unified deployment scripts and CodeQL sensitive log alerts by @aarora79 in #421 Fix: Return correct 4xx status codes from auth server by @aarora79 in #423 Feature: Clean up ingress annotations, add allowed inbound cidr ranges by @omrishiv in #425 Feature: Add build/push workflow by @omrishiv in #432 Feature: High availability deployment and README updates by @omrishiv in #437 Feature: Federation registry: Peer-to-peer sync support by @dheerajoruganty in #422 Feature: Bump urllib3 from 2.5.0 to 2.6.3 in agents/a2a by @dependabot[bot] in #435 Featur

Goal Reached Thanks to every supporter — we hit 100%!

mcp-gateway-registry v1.0.13: SSRF (CVE-918), SQLi, Info Disclosure Fix

More from this source