MCP Identity Gateway security updates
MCP Identity Gateway version 1.34.5794 includes security updates.
For the latest available versions of these components, see the Edge Components Supported Versions page.
Changelog — Security
Edge components dependency security updates
Agent Proxy 1.34.5755 and Aembit CLI 1.34.5772 fix two published Rust advisories in bundled third-party libraries:
RUSTSEC-2026-0190 in anyhow and
RUSTSEC-2026-0204 in crossbeam-epoch.
The same build upgrades the quinn, AWS SDK, pcap, and postgres-protocol dependencies.
Agent Injector 1.34.433 fixes RUSTSEC-2026-0185 in
quinn-proto.
These updates shipped in the same build as the Edge components release with Agent Proxy fixes and expanded workload events.
MCP Identity Gateway content inspection coverage
A security update for the MCP Identity Gateway broadens the MCP traffic that Content Security inspects.
The Gateway normalizes responses that MCP servers stream as server-sent events before inspection, so Content Security inspects those responses along with the rest of the session. The Gateway also applies the policy’s Fail Open on Error setting to requests it can’t read and to protocol errors. A policy set to fail closed blocks those requests.
These updates shipped in the same build as the MCP Identity Gateway 1.33.5654 release.
MCP Identity Gateway dependency security updates
A security update for the MCP Identity Gateway advances two bundled third-party libraries to their latest patched releases, keeping the Gateway current with published advisories.
These updates shipped in the same build as the MCP Identity Gateway 1.33.5547 release.
Agent Controller container security hardening
Agent Controller 1.32.3541 includes security hardening for the container image that reduces its attack surface and strengthens supply chain integrity. The image now ships with a bundled software bill of materials for greater transparency into its contents.
MCP Identity Gateway session IDs are now bound to the authenticated user
MCP Identity Gateway now binds each session ID to the authenticated user, closing a privilege-escalation gap where one user’s session could carry over to another identity.
This change requires no configuration. It ships in MCP Identity Gateway 1.32.5098, alongside the workload event correlation and platform fixes in this build; see the event correlation and platform fixes entry.
Agent Proxy security update for a DNS library vulnerability
A security update for Agent Proxy resolves a vulnerability in a bundled DNS library.
This fix shipped in the same build as the Edge components release with reliability, CLI, and MCP enhancements, across the Agent Proxy container, virtual machine package, and AWS Lambda deployments.
Edge components release with container base image security update
Aembit has released new versions of the following components and packages:
- Helm Chart
- Terraform ECS module
- AWS Lambda Extension
- AWS Lambda Layer
- Agent Proxy
- Agent Injector
- Sidecar Init
For the latest available versions of these components, see the Edge Components Supported Versions page.
Key Updates:
- Applied a security enhancement to container-base images
Aembit container images are now cryptographically signed
Aembit now cryptographically signs all container images in Aembit’s Docker Hub repositories. See Verifying Aembit container image signatures for more details and how to verify Aembit container images.
Kerberos and PKI security enhancements for Agent Proxy
Aembit has released a new version of Agent Controller, version 1.23.2160, with the following changes:
-
Security enhancements for Kerberos and Aembit-managed PKI.
-
Added the
AEMBIT_HTTP_PORT_DISABLEDenvironment variable to enable you to disable Agent Controller’s HTTP port.
Updated Edge Components:
- Agent Proxy 1.23.2160
Updated Edge Packages:
-
Helm Chart 1.23
-
Terraform ECS module 1.23
See Edge Components supported versions for more details.