Search
Find a vulnerability
Search criteria
4 vulnerabilities found for ContextForge MCP Gateway by IBM
CVE-2026-18486 (GCVE-0-2026-18486)
Vulnerability from nvd – Published: 2026-09-04 16:24 – Updated: 2026-09-04 16:24
VLAI
EPSS
VEX
Title
IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter execution
Summary
IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters.
Severity
8.8 (High)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7286052 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | ContextForge MCP Gateway |
Affected:
<= v1.0.7
cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*"
],
"product": "ContextForge MCP Gateway",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "\u003c= v1.0.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM ContextForge MCP Gateway \u0026lt;= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters.\u003c/p\u003e"
}
],
"value": "IBM ContextForge MCP Gateway \u003c= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T16:24:45.432Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7286052"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability now.\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion(s) number and/or range\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eRemediation/Fix/Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM ContextForge MCP Gateway\u003c/td\u003e\u003ctd\u003e\u0026lt;=v1.0.7\u003c/td\u003e\u003ctd\u003eUpgrade to v1.0.8. See [release notes](\u003ca href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.8%29\" rel=\"nofollow\"\u003ehttps://github.com/IBM/mcp-context-forge/releases/tag/v1.0.8)\u003c/a\u003e. Rotate `JWT_SECRET_KEY`, `AUTH_ENCRYPTION_SECRET`, `DATABASE_URL`, `REDIS_URL`, and `BASIC_AUTH_PASSWORD` on any deployment running prior versions.\u003cbr/\u003e\u003cbr/\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u00a0 Note: From version v1.0.8 on a more complex AUTH_ENCRYPTION_SECRET is required:\u003cbr/\u003eAction required before upgrading: run the one-shot re-encryption script (\u003ccode\u003emcpgateway/scripts/migrate_enc_secret.py\u003c/code\u003e) with the old and new keys while the gateway is stopped. See the full rotation guide at \u003ca href=\"https://github.com/IBM/mcp-context-forge/blob/v1.0.8/docs/docs/operations/auth-encryption-secret-rotation.md\" rel=\"nofollow\"\u003e\u003ccode\u003edocs/docs/operations/auth-encryption-secret-rotation.md\u003c/code\u003e\u003c/a\u003e for step-by-step instructions, deployment-specific commands, and special cases (Helm/Kubernetes, Python package consumers, rollback).\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM ContextForge MCP Gateway\u003c=v1.0.7Upgrade to v1.0.8. See [release notes]( https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.8) https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.8%29 . Rotate `JWT_SECRET_KEY`, `AUTH_ENCRYPTION_SECRET`, `DATABASE_URL`, `REDIS_URL`, and `BASIC_AUTH_PASSWORD` on any deployment running prior versions.\n\n\n\n\n\n\n\n\n\n\u00a0 Note: From version v1.0.8 on a more complex AUTH_ENCRYPTION_SECRET is required:\nAction required before upgrading: run the one-shot re-encryption script (mcpgateway/scripts/migrate_enc_secret.py) with the old and new keys while the gateway is stopped. See the full rotation guide at docs/docs/operations/auth-encryption-secret-rotation.md https://github.com/IBM/mcp-context-forge/blob/v1.0.8/docs/docs/operations/auth-encryption-secret-rotation.md for step-by-step instructions, deployment-specific commands, and special cases (Helm/Kubernetes, Python package consumers, rollback)."
}
],
"title": "IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter execution",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eNone. IBM strongly recommends upgrading to the fixed version and rotating server credentials.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "None. IBM strongly recommends upgrading to the fixed version and rotating server credentials."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-18486",
"datePublished": "2026-09-04T16:24:45.432Z",
"dateReserved": "2026-07-31T13:30:12.746Z",
"dateUpdated": "2026-09-04T16:24:45.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77822 (GCVE-0-2026-77822)
Vulnerability from nvd – Published: 2026-09-04 15:15 – Updated: 2026-09-04 18:24
VLAI
EPSS
VEX
Title
IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint
Summary
IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 17:09 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7286055 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | ContextForge MCP Gateway |
Affected:
<= v1.0.8
cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77822",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T17:09:15.348543Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T18:24:58.315Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*"
],
"product": "ContextForge MCP Gateway",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "\u003c= v1.0.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.\u003c/p\u003e"
}
],
"value": "IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T15:15:35.403Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7286055"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003c/div\u003e\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability now.\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion(s) number and/or range\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eRemediation/Fix/Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM ContextForge MCP Gateway\u003c/td\u003e\u003ctd\u003e\u0026lt;= v1.0.8\u003c/td\u003e\u003ctd\u003eUpgrade to v1.0.9\u00a0\n\u003cdiv\u003e\u003cdiv\u003e\u003ca href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9\" rel=\"nofollow\"\u003ehttps://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9\u003c/a\u003e\u003c/div\u003e\u003c/div\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u00a0Note: \u0026lt;Component A / B names\u0026gt; are bundled with \u0026lt;Product profile name\u0026gt; to provide \u0026lt;feature / function description\u0026gt;\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM ContextForge MCP Gateway\u003c= v1.0.8Upgrade to v1.0.9\u00a0\n https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9 \n\n\n\n\n\n\n\n\u00a0Note: \u003cComponent A / B names\u003e are bundled with \u003cProduct profile name\u003e to provide \u003cfeature / function description\u003e"
}
],
"title": "IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eOperators who cannot immediately upgrade can reduce exposure by:\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003e1. **Disable A2A** \u2014 set the environment variable `MCPGATEWAY_A2A_ENABLED=False` to disable the A2A subsystem entirely. This removes the vulnerable endpoint from the attack surface at the cost of A2A functionality.\u003c/div\u003e\u003cdiv\u003e2. **Restrict A2A create/invoke permissions** \u2014 revoke A2A creation and invocation rights from developer and team_admin roles in environments where A2A is not required.\u003c/div\u003e\u003cdiv\u003e3. **Network-level egress controls** \u2014 enforce outbound network policy at the host or cloud level to block the gateway process from reaching cloud metadata endpoints and private RFC 1918 address ranges, preventing exploitation of the DNS-rebinding window even if a rebind attempt succeeds.\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003eNone of these mitigations eliminate the underlying vulnerability; IBM strongly recommends upgrading to the fixed version.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Operators who cannot immediately upgrade can reduce exposure by:\n\n\n1. **Disable A2A** \u2014 set the environment variable `MCPGATEWAY_A2A_ENABLED=False` to disable the A2A subsystem entirely. This removes the vulnerable endpoint from the attack surface at the cost of A2A functionality.\n\n2. **Restrict A2A create/invoke permissions** \u2014 revoke A2A creation and invocation rights from developer and team_admin roles in environments where A2A is not required.\n\n3. **Network-level egress controls** \u2014 enforce outbound network policy at the host or cloud level to block the gateway process from reaching cloud metadata endpoints and private RFC 1918 address ranges, preventing exploitation of the DNS-rebinding window even if a rebind attempt succeeds.\n\n\nNone of these mitigations eliminate the underlying vulnerability; IBM strongly recommends upgrading to the fixed version."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-77822",
"datePublished": "2026-09-04T15:15:35.403Z",
"dateReserved": "2026-08-21T14:36:12.469Z",
"dateUpdated": "2026-09-04T18:24:58.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18486 (GCVE-0-2026-18486)
Vulnerability from cvelistv5 – Published: 2026-09-04 16:24 – Updated: 2026-09-04 16:24
VLAI
EPSS
VEX
Title
IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter execution
Summary
IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters.
Severity
8.8 (High)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7286052 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | ContextForge MCP Gateway |
Affected:
<= v1.0.7
cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*"
],
"product": "ContextForge MCP Gateway",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "\u003c= v1.0.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM ContextForge MCP Gateway \u0026lt;= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters.\u003c/p\u003e"
}
],
"value": "IBM ContextForge MCP Gateway \u003c= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T16:24:45.432Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7286052"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability now.\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion(s) number and/or range\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eRemediation/Fix/Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM ContextForge MCP Gateway\u003c/td\u003e\u003ctd\u003e\u0026lt;=v1.0.7\u003c/td\u003e\u003ctd\u003eUpgrade to v1.0.8. See [release notes](\u003ca href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.8%29\" rel=\"nofollow\"\u003ehttps://github.com/IBM/mcp-context-forge/releases/tag/v1.0.8)\u003c/a\u003e. Rotate `JWT_SECRET_KEY`, `AUTH_ENCRYPTION_SECRET`, `DATABASE_URL`, `REDIS_URL`, and `BASIC_AUTH_PASSWORD` on any deployment running prior versions.\u003cbr/\u003e\u003cbr/\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u00a0 Note: From version v1.0.8 on a more complex AUTH_ENCRYPTION_SECRET is required:\u003cbr/\u003eAction required before upgrading: run the one-shot re-encryption script (\u003ccode\u003emcpgateway/scripts/migrate_enc_secret.py\u003c/code\u003e) with the old and new keys while the gateway is stopped. See the full rotation guide at \u003ca href=\"https://github.com/IBM/mcp-context-forge/blob/v1.0.8/docs/docs/operations/auth-encryption-secret-rotation.md\" rel=\"nofollow\"\u003e\u003ccode\u003edocs/docs/operations/auth-encryption-secret-rotation.md\u003c/code\u003e\u003c/a\u003e for step-by-step instructions, deployment-specific commands, and special cases (Helm/Kubernetes, Python package consumers, rollback).\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM ContextForge MCP Gateway\u003c=v1.0.7Upgrade to v1.0.8. See [release notes]( https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.8) https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.8%29 . Rotate `JWT_SECRET_KEY`, `AUTH_ENCRYPTION_SECRET`, `DATABASE_URL`, `REDIS_URL`, and `BASIC_AUTH_PASSWORD` on any deployment running prior versions.\n\n\n\n\n\n\n\n\n\n\u00a0 Note: From version v1.0.8 on a more complex AUTH_ENCRYPTION_SECRET is required:\nAction required before upgrading: run the one-shot re-encryption script (mcpgateway/scripts/migrate_enc_secret.py) with the old and new keys while the gateway is stopped. See the full rotation guide at docs/docs/operations/auth-encryption-secret-rotation.md https://github.com/IBM/mcp-context-forge/blob/v1.0.8/docs/docs/operations/auth-encryption-secret-rotation.md for step-by-step instructions, deployment-specific commands, and special cases (Helm/Kubernetes, Python package consumers, rollback)."
}
],
"title": "IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter execution",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eNone. IBM strongly recommends upgrading to the fixed version and rotating server credentials.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "None. IBM strongly recommends upgrading to the fixed version and rotating server credentials."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-18486",
"datePublished": "2026-09-04T16:24:45.432Z",
"dateReserved": "2026-07-31T13:30:12.746Z",
"dateUpdated": "2026-09-04T16:24:45.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77822 (GCVE-0-2026-77822)
Vulnerability from cvelistv5 – Published: 2026-09-04 15:15 – Updated: 2026-09-04 18:24
VLAI
EPSS
VEX
Title
IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint
Summary
IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 17:09 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7286055 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | ContextForge MCP Gateway |
Affected:
<= v1.0.8
cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77822",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T17:09:15.348543Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T18:24:58.315Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*"
],
"product": "ContextForge MCP Gateway",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "\u003c= v1.0.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.\u003c/p\u003e"
}
],
"value": "IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T15:15:35.403Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7286055"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003c/div\u003e\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability now.\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion(s) number and/or range\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eRemediation/Fix/Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM ContextForge MCP Gateway\u003c/td\u003e\u003ctd\u003e\u0026lt;= v1.0.8\u003c/td\u003e\u003ctd\u003eUpgrade to v1.0.9\u00a0\n\u003cdiv\u003e\u003cdiv\u003e\u003ca href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9\" rel=\"nofollow\"\u003ehttps://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9\u003c/a\u003e\u003c/div\u003e\u003c/div\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u00a0Note: \u0026lt;Component A / B names\u0026gt; are bundled with \u0026lt;Product profile name\u0026gt; to provide \u0026lt;feature / function description\u0026gt;\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM ContextForge MCP Gateway\u003c= v1.0.8Upgrade to v1.0.9\u00a0\n https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9 \n\n\n\n\n\n\n\n\u00a0Note: \u003cComponent A / B names\u003e are bundled with \u003cProduct profile name\u003e to provide \u003cfeature / function description\u003e"
}
],
"title": "IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eOperators who cannot immediately upgrade can reduce exposure by:\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003e1. **Disable A2A** \u2014 set the environment variable `MCPGATEWAY_A2A_ENABLED=False` to disable the A2A subsystem entirely. This removes the vulnerable endpoint from the attack surface at the cost of A2A functionality.\u003c/div\u003e\u003cdiv\u003e2. **Restrict A2A create/invoke permissions** \u2014 revoke A2A creation and invocation rights from developer and team_admin roles in environments where A2A is not required.\u003c/div\u003e\u003cdiv\u003e3. **Network-level egress controls** \u2014 enforce outbound network policy at the host or cloud level to block the gateway process from reaching cloud metadata endpoints and private RFC 1918 address ranges, preventing exploitation of the DNS-rebinding window even if a rebind attempt succeeds.\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003eNone of these mitigations eliminate the underlying vulnerability; IBM strongly recommends upgrading to the fixed version.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Operators who cannot immediately upgrade can reduce exposure by:\n\n\n1. **Disable A2A** \u2014 set the environment variable `MCPGATEWAY_A2A_ENABLED=False` to disable the A2A subsystem entirely. This removes the vulnerable endpoint from the attack surface at the cost of A2A functionality.\n\n2. **Restrict A2A create/invoke permissions** \u2014 revoke A2A creation and invocation rights from developer and team_admin roles in environments where A2A is not required.\n\n3. **Network-level egress controls** \u2014 enforce outbound network policy at the host or cloud level to block the gateway process from reaching cloud metadata endpoints and private RFC 1918 address ranges, preventing exploitation of the DNS-rebinding window even if a rebind attempt succeeds.\n\n\nNone of these mitigations eliminate the underlying vulnerability; IBM strongly recommends upgrading to the fixed version."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-77822",
"datePublished": "2026-09-04T15:15:35.403Z",
"dateReserved": "2026-08-21T14:36:12.469Z",
"dateUpdated": "2026-09-04T18:24:58.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}