GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    8 vulnerabilities found for contextforge by ibm

    CVE-2026-18489 (GCVE-0-2026-18489)

    Vulnerability from nvd – Published: 2026-09-04 16:23 – Updated: 2026-09-04 17:29
    VLAI
    Title
    IBM ContextForge Translate is affected by cross-client credential context confusion
    Summary
    IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.
    Severity
    7.4 (High)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 17:29 UTC
    CWE
    • CWE-488 - Exposure of Data Element to Wrong Session
    Assigner
    References
    URL Tags
    https://www.ibm.com/support/pages/node/7286056 vendor-advisorypatch
    Impacted products
    Vendor Product Version
    IBM ContextForge MCP Gateway - Translate utility Affected: <= 1.0.8
        cpe:2.3:a:ibm:contextforge_mcp_gateway_translate_utility:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18489",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T17:29:48.993058Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T17:29:57.267Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:contextforge_mcp_gateway_translate_utility:*:*:*:*:*:*:*:*"
          ],
          "product": "ContextForge MCP Gateway - Translate utility",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.0.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM ContextForge MCP Gateway - Translate utility \u0026lt;= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.\u003c/p\u003e"
            }
          ],
          "value": "IBM ContextForge MCP Gateway - Translate utility \u003c= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-488",
              "description": "CWE-488 Exposure of Data Element to Wrong Session",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T16:23:08.905Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7286056"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003eIBM strongly recommends addressing the vulnerability now.\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003eThe IBM ContextForge Translate service is intended **only for local, single-session development use**. It does not provide the session isolation required for production or multi-client deployments. Users must ensure the Translate service is not exposed in any production capacity.\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003ePR [#6388](\u003ca href=\"https://github.com/IBM/mcp-context-forge/pull/6388%29\" rel=\"nofollow\"\u003ehttps://github.com/IBM/mcp-context-forge/pull/6388)\u003c/a\u003e (merged 2026-08-24) updates the product documentation to make this restriction explicit, removing previous guidance that could have implied multi-tenant production suitability.\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerability now.\n\n\nThe IBM ContextForge Translate service is intended **only for local, single-session development use**. It does not provide the session isolation required for production or multi-client deployments. Users must ensure the Translate service is not exposed in any production capacity.\n\n\nPR [#6388]( https://github.com/IBM/mcp-context-forge/pull/6388) https://github.com/IBM/mcp-context-forge/pull/6388%29  (merged 2026-08-24) updates the product documentation to make this restriction explicit, removing previous guidance that could have implied multi-tenant production suitability."
        }
      ],
      "title": "IBM ContextForge Translate is affected by cross-client credential context confusion",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003eDo not use the IBM ContextForge Translate service in any production or multi-client environment. The service is designed exclusively for local development scenarios where only a single client session is expected. This applies regardless of whether `--enable-dynamic-env` is active.\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003eIf the Translate service is currently running in a non-development environment:\u003c/div\u003e\u003cdiv\u003e1. Stop the Translate service and remove it from any production deployment immediately.\u003c/div\u003e\u003cdiv\u003e2. Rotate any credentials (API tokens, `Authorization` headers) that may have been mapped into the shared subprocess environment while multiple clients were connected.\u003c/div\u003e\u003cdiv\u003e3. Review audit logs for tool calls where the HTTP caller identity may not match the subprocess credential context.\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "Do not use the IBM ContextForge Translate service in any production or multi-client environment. The service is designed exclusively for local development scenarios where only a single client session is expected. This applies regardless of whether `--enable-dynamic-env` is active.\n\n\nIf the Translate service is currently running in a non-development environment:\n\n1. Stop the Translate service and remove it from any production deployment immediately.\n\n2. Rotate any credentials (API tokens, `Authorization` headers) that may have been mapped into the shared subprocess environment while multiple clients were connected.\n\n3. Review audit logs for tool calls where the HTTP caller identity may not match the subprocess credential context."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-18489",
    "datePublished": "2026-09-04T16:23:08.905Z",
    "dateReserved": "2026-07-31T13:49:30.524Z",
    "dateUpdated": "2026-09-04T17:29:57.267Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-18486 (GCVE-0-2026-18486)

    Vulnerability from nvd – Published: 2026-09-04 16:24 – Updated: 2026-09-10 15:07
    VLAI
    Title
    IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter execution
    Summary
    IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-09 18:28 UTC
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    References
    URL Tags
    https://www.ibm.com/support/pages/node/7286052 vendor-advisorypatch
    Impacted products
    Vendor Product Version
    IBM ContextForge MCP Gateway Affected: <= v1.0.7
        cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18486",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T18:28:48.646615Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T15:07:06.035Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*"
          ],
          "product": "ContextForge MCP Gateway",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= v1.0.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM ContextForge MCP Gateway \u0026lt;= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters.\u003c/p\u003e"
            }
          ],
          "value": "IBM ContextForge MCP Gateway \u003c= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T16:24:45.432Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7286052"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability now.\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion(s) number and/or range\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eRemediation/Fix/Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM ContextForge MCP Gateway\u003c/td\u003e\u003ctd\u003e\u0026lt;=v1.0.7\u003c/td\u003e\u003ctd\u003eUpgrade to v1.0.8. See [release notes](\u003ca href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.8%29\" rel=\"nofollow\"\u003ehttps://github.com/IBM/mcp-context-forge/releases/tag/v1.0.8)\u003c/a\u003e. Rotate `JWT_SECRET_KEY`, `AUTH_ENCRYPTION_SECRET`, `DATABASE_URL`, `REDIS_URL`, and `BASIC_AUTH_PASSWORD` on any deployment running prior versions.\u003cbr/\u003e\u003cbr/\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u00a0 Note: From version v1.0.8 on a more complex AUTH_ENCRYPTION_SECRET is required:\u003cbr/\u003eAction required before upgrading: run the one-shot re-encryption script (\u003ccode\u003emcpgateway/scripts/migrate_enc_secret.py\u003c/code\u003e) with the old and new keys while the gateway is stopped. See the full rotation guide at \u003ca href=\"https://github.com/IBM/mcp-context-forge/blob/v1.0.8/docs/docs/operations/auth-encryption-secret-rotation.md\" rel=\"nofollow\"\u003e\u003ccode\u003edocs/docs/operations/auth-encryption-secret-rotation.md\u003c/code\u003e\u003c/a\u003e for step-by-step instructions, deployment-specific commands, and special cases (Helm/Kubernetes, Python package consumers, rollback).\u003c/p\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM ContextForge MCP Gateway\u003c=v1.0.7Upgrade to v1.0.8. See [release notes]( https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.8) https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.8%29 . Rotate `JWT_SECRET_KEY`, `AUTH_ENCRYPTION_SECRET`, `DATABASE_URL`, `REDIS_URL`, and `BASIC_AUTH_PASSWORD` on any deployment running prior versions.\n\n\n\n\n\n\n\n\n\n\u00a0 Note: From version v1.0.8 on a more complex AUTH_ENCRYPTION_SECRET is required:\nAction required before upgrading: run the one-shot re-encryption script (mcpgateway/scripts/migrate_enc_secret.py) with the old and new keys while the gateway is stopped. See the full rotation guide at  docs/docs/operations/auth-encryption-secret-rotation.md https://github.com/IBM/mcp-context-forge/blob/v1.0.8/docs/docs/operations/auth-encryption-secret-rotation.md  for step-by-step instructions, deployment-specific commands, and special cases (Helm/Kubernetes, Python package consumers, rollback)."
        }
      ],
      "title": "IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter execution",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003eNone. IBM strongly recommends upgrading to the fixed version and rotating server credentials.\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "None. IBM strongly recommends upgrading to the fixed version and rotating server credentials."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-18486",
    "datePublished": "2026-09-04T16:24:45.432Z",
    "dateReserved": "2026-07-31T13:30:12.746Z",
    "dateUpdated": "2026-09-10T15:07:06.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-77822 (GCVE-0-2026-77822)

    Vulnerability from nvd – Published: 2026-09-04 15:15 – Updated: 2026-09-04 18:24
    VLAI
    Title
    IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint
    Summary
    IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.
    Severity
    8.2 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 17:09 UTC
    CWE
    • CWE-918 - Server-Side Request Forgery (SSRF)
    Assigner
    References
    URL Tags
    https://www.ibm.com/support/pages/node/7286055 vendor-advisorypatch
    Impacted products
    Vendor Product Version
    IBM ContextForge MCP Gateway Affected: <= v1.0.8
        cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77822",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T17:09:15.348543Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T18:24:58.315Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*"
          ],
          "product": "ContextForge MCP Gateway",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= v1.0.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.\u003c/p\u003e"
            }
          ],
          "value": "IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T15:15:35.403Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7286055"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003c/div\u003e\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability now.\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion(s) number and/or range\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eRemediation/Fix/Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM ContextForge MCP Gateway\u003c/td\u003e\u003ctd\u003e\u0026lt;= v1.0.8\u003c/td\u003e\u003ctd\u003eUpgrade to v1.0.9\u00a0\n\u003cdiv\u003e\u003cdiv\u003e\u003ca href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9\" rel=\"nofollow\"\u003ehttps://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9\u003c/a\u003e\u003c/div\u003e\u003c/div\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u00a0Note: \u0026lt;Component A / B names\u0026gt; are bundled with \u0026lt;Product profile name\u0026gt; to provide \u0026lt;feature / function description\u0026gt;\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM ContextForge MCP Gateway\u003c= v1.0.8Upgrade to v1.0.9\u00a0\n https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9 \n\n\n\n\n\n\n\n\u00a0Note: \u003cComponent A / B names\u003e are bundled with \u003cProduct profile name\u003e to provide \u003cfeature / function description\u003e"
        }
      ],
      "title": "IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003eOperators who cannot immediately upgrade can reduce exposure by:\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003e1. **Disable A2A** \u2014 set the environment variable `MCPGATEWAY_A2A_ENABLED=False` to disable the A2A subsystem entirely. This removes the vulnerable endpoint from the attack surface at the cost of A2A functionality.\u003c/div\u003e\u003cdiv\u003e2. **Restrict A2A create/invoke permissions** \u2014 revoke A2A creation and invocation rights from developer and team_admin roles in environments where A2A is not required.\u003c/div\u003e\u003cdiv\u003e3. **Network-level egress controls** \u2014 enforce outbound network policy at the host or cloud level to block the gateway process from reaching cloud metadata endpoints and private RFC 1918 address ranges, preventing exploitation of the DNS-rebinding window even if a rebind attempt succeeds.\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003eNone of these mitigations eliminate the underlying vulnerability; IBM strongly recommends upgrading to the fixed version.\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "Operators who cannot immediately upgrade can reduce exposure by:\n\n\n1. **Disable A2A** \u2014 set the environment variable `MCPGATEWAY_A2A_ENABLED=False` to disable the A2A subsystem entirely. This removes the vulnerable endpoint from the attack surface at the cost of A2A functionality.\n\n2. **Restrict A2A create/invoke permissions** \u2014 revoke A2A creation and invocation rights from developer and team_admin roles in environments where A2A is not required.\n\n3. **Network-level egress controls** \u2014 enforce outbound network policy at the host or cloud level to block the gateway process from reaching cloud metadata endpoints and private RFC 1918 address ranges, preventing exploitation of the DNS-rebinding window even if a rebind attempt succeeds.\n\n\nNone of these mitigations eliminate the underlying vulnerability; IBM strongly recommends upgrading to the fixed version."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-77822",
    "datePublished": "2026-09-04T15:15:35.403Z",
    "dateReserved": "2026-08-21T14:36:12.469Z",
    "dateUpdated": "2026-09-04T18:24:58.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-18905 (GCVE-0-2026-18905)

    Vulnerability from nvd – Published: 2026-09-04 15:56 – Updated: 2026-09-04 18:24
    VLAI
    Title
    IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation
    Summary
    IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation.
    Severity
    7.7 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 17:39 UTC
    CWE
    • CWE-918 - Server-Side Request Forgery (SSRF)
    Assigner
    References
    URL Tags
    https://www.ibm.com/support/pages/node/7286053 vendor-advisorypatch
    Impacted products
    Vendor Product Version
    IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) Affected: <= v1.0.6
        cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18905",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T17:39:59.136548Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T18:24:43.388Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*"
          ],
          "product": "ContextForge MCP Gateway (`mcp-contextforge-gateway`)",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= v1.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) \u0026lt;= v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation.\u003c/p\u003e"
            }
          ],
          "value": "IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) \u003c= v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T15:56:28.239Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7286053"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003c/div\u003e\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability now.\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion(s) number and/or range\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eRemediation/Fix/Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM ContextForge MCP Gateway\u003c/td\u003e\u003ctd\u003e\u0026lt;=v1.0.6\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://ibm.service-now.com/kb_view.do?sysparm_article=KB0021096\" rel=\"nofollow\"\u003eUpgrade to v1.0.7 or higher. \u003c/a\u003e\u003ca href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.7%29\" rel=\"nofollow\"\u003ehttps://github.com/IBM/mcp-context-forge/releases/tag/v1.0.7\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u00a0Note:\u003c/p\u003e\u003cdiv\u003e_Fix merged: 2026-07-29_\u003c/div\u003e\u003cdiv\u003e_Fixing PR: \u003ca href=\"https://github.com/IBM/mcp-context-forge/pull/5925_\" rel=\"nofollow\"\u003ehttps://github.com/IBM/mcp-context-forge/pull/5925_\u003c/a\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM ContextForge MCP Gateway\u003c=v1.0.6 https://github.com/IBM/mcp-context-forge/pull/5925_"
        }
      ],
      "title": "IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003eWorkarounds/Mitigation guidance\u003c/strong\u003e:\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003eNo complete workaround exists without upgrading. As a partial mitigation, restrict tool-creation\u003c/div\u003e\u003cdiv\u003epermissions (`tools.create`) to fully trusted users only, limiting the pool of accounts that could\u003c/div\u003e\u003cdiv\u003estage a registration with a controlled hostname. This does not eliminate the vulnerability but\u003c/div\u003e\u003cdiv\u003ereduces exposure in environments where least-privilege access controls are enforced.\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003eIBM strongly recommends upgrading to v1.0.7 or higher.\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "Workarounds/Mitigation guidance:\n\nNo complete workaround exists without upgrading. As a partial mitigation, restrict tool-creation\n\npermissions (`tools.create`) to fully trusted users only, limiting the pool of accounts that could\n\nstage a registration with a controlled hostname. This does not eliminate the vulnerability but\n\nreduces exposure in environments where least-privilege access controls are enforced.\n\n\nIBM strongly recommends upgrading to v1.0.7 or higher."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-18905",
    "datePublished": "2026-09-04T15:56:28.239Z",
    "dateReserved": "2026-08-04T20:21:18.671Z",
    "dateUpdated": "2026-09-04T18:24:43.388Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-18486 (GCVE-0-2026-18486)

    Vulnerability from cvelistv5 – Published: 2026-09-04 16:24 – Updated: 2026-09-10 15:07
    VLAI
    Title
    IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter execution
    Summary
    IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-09 18:28 UTC
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    References
    URL Tags
    https://www.ibm.com/support/pages/node/7286052 vendor-advisorypatch
    Impacted products
    Vendor Product Version
    IBM ContextForge MCP Gateway Affected: <= v1.0.7
        cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18486",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T18:28:48.646615Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T15:07:06.035Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*"
          ],
          "product": "ContextForge MCP Gateway",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= v1.0.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM ContextForge MCP Gateway \u0026lt;= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters.\u003c/p\u003e"
            }
          ],
          "value": "IBM ContextForge MCP Gateway \u003c= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T16:24:45.432Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7286052"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability now.\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion(s) number and/or range\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eRemediation/Fix/Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM ContextForge MCP Gateway\u003c/td\u003e\u003ctd\u003e\u0026lt;=v1.0.7\u003c/td\u003e\u003ctd\u003eUpgrade to v1.0.8. See [release notes](\u003ca href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.8%29\" rel=\"nofollow\"\u003ehttps://github.com/IBM/mcp-context-forge/releases/tag/v1.0.8)\u003c/a\u003e. Rotate `JWT_SECRET_KEY`, `AUTH_ENCRYPTION_SECRET`, `DATABASE_URL`, `REDIS_URL`, and `BASIC_AUTH_PASSWORD` on any deployment running prior versions.\u003cbr/\u003e\u003cbr/\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u00a0 Note: From version v1.0.8 on a more complex AUTH_ENCRYPTION_SECRET is required:\u003cbr/\u003eAction required before upgrading: run the one-shot re-encryption script (\u003ccode\u003emcpgateway/scripts/migrate_enc_secret.py\u003c/code\u003e) with the old and new keys while the gateway is stopped. See the full rotation guide at \u003ca href=\"https://github.com/IBM/mcp-context-forge/blob/v1.0.8/docs/docs/operations/auth-encryption-secret-rotation.md\" rel=\"nofollow\"\u003e\u003ccode\u003edocs/docs/operations/auth-encryption-secret-rotation.md\u003c/code\u003e\u003c/a\u003e for step-by-step instructions, deployment-specific commands, and special cases (Helm/Kubernetes, Python package consumers, rollback).\u003c/p\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM ContextForge MCP Gateway\u003c=v1.0.7Upgrade to v1.0.8. See [release notes]( https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.8) https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.8%29 . Rotate `JWT_SECRET_KEY`, `AUTH_ENCRYPTION_SECRET`, `DATABASE_URL`, `REDIS_URL`, and `BASIC_AUTH_PASSWORD` on any deployment running prior versions.\n\n\n\n\n\n\n\n\n\n\u00a0 Note: From version v1.0.8 on a more complex AUTH_ENCRYPTION_SECRET is required:\nAction required before upgrading: run the one-shot re-encryption script (mcpgateway/scripts/migrate_enc_secret.py) with the old and new keys while the gateway is stopped. See the full rotation guide at  docs/docs/operations/auth-encryption-secret-rotation.md https://github.com/IBM/mcp-context-forge/blob/v1.0.8/docs/docs/operations/auth-encryption-secret-rotation.md  for step-by-step instructions, deployment-specific commands, and special cases (Helm/Kubernetes, Python package consumers, rollback)."
        }
      ],
      "title": "IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter execution",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003eNone. IBM strongly recommends upgrading to the fixed version and rotating server credentials.\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "None. IBM strongly recommends upgrading to the fixed version and rotating server credentials."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-18486",
    "datePublished": "2026-09-04T16:24:45.432Z",
    "dateReserved": "2026-07-31T13:30:12.746Z",
    "dateUpdated": "2026-09-10T15:07:06.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-18489 (GCVE-0-2026-18489)

    Vulnerability from cvelistv5 – Published: 2026-09-04 16:23 – Updated: 2026-09-04 17:29
    VLAI
    Title
    IBM ContextForge Translate is affected by cross-client credential context confusion
    Summary
    IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.
    Severity
    7.4 (High)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 17:29 UTC
    CWE
    • CWE-488 - Exposure of Data Element to Wrong Session
    Assigner
    References
    URL Tags
    https://www.ibm.com/support/pages/node/7286056 vendor-advisorypatch
    Impacted products
    Vendor Product Version
    IBM ContextForge MCP Gateway - Translate utility Affected: <= 1.0.8
        cpe:2.3:a:ibm:contextforge_mcp_gateway_translate_utility:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18489",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T17:29:48.993058Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T17:29:57.267Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:contextforge_mcp_gateway_translate_utility:*:*:*:*:*:*:*:*"
          ],
          "product": "ContextForge MCP Gateway - Translate utility",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.0.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM ContextForge MCP Gateway - Translate utility \u0026lt;= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.\u003c/p\u003e"
            }
          ],
          "value": "IBM ContextForge MCP Gateway - Translate utility \u003c= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-488",
              "description": "CWE-488 Exposure of Data Element to Wrong Session",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T16:23:08.905Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7286056"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003eIBM strongly recommends addressing the vulnerability now.\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003eThe IBM ContextForge Translate service is intended **only for local, single-session development use**. It does not provide the session isolation required for production or multi-client deployments. Users must ensure the Translate service is not exposed in any production capacity.\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003ePR [#6388](\u003ca href=\"https://github.com/IBM/mcp-context-forge/pull/6388%29\" rel=\"nofollow\"\u003ehttps://github.com/IBM/mcp-context-forge/pull/6388)\u003c/a\u003e (merged 2026-08-24) updates the product documentation to make this restriction explicit, removing previous guidance that could have implied multi-tenant production suitability.\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerability now.\n\n\nThe IBM ContextForge Translate service is intended **only for local, single-session development use**. It does not provide the session isolation required for production or multi-client deployments. Users must ensure the Translate service is not exposed in any production capacity.\n\n\nPR [#6388]( https://github.com/IBM/mcp-context-forge/pull/6388) https://github.com/IBM/mcp-context-forge/pull/6388%29  (merged 2026-08-24) updates the product documentation to make this restriction explicit, removing previous guidance that could have implied multi-tenant production suitability."
        }
      ],
      "title": "IBM ContextForge Translate is affected by cross-client credential context confusion",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003eDo not use the IBM ContextForge Translate service in any production or multi-client environment. The service is designed exclusively for local development scenarios where only a single client session is expected. This applies regardless of whether `--enable-dynamic-env` is active.\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003eIf the Translate service is currently running in a non-development environment:\u003c/div\u003e\u003cdiv\u003e1. Stop the Translate service and remove it from any production deployment immediately.\u003c/div\u003e\u003cdiv\u003e2. Rotate any credentials (API tokens, `Authorization` headers) that may have been mapped into the shared subprocess environment while multiple clients were connected.\u003c/div\u003e\u003cdiv\u003e3. Review audit logs for tool calls where the HTTP caller identity may not match the subprocess credential context.\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "Do not use the IBM ContextForge Translate service in any production or multi-client environment. The service is designed exclusively for local development scenarios where only a single client session is expected. This applies regardless of whether `--enable-dynamic-env` is active.\n\n\nIf the Translate service is currently running in a non-development environment:\n\n1. Stop the Translate service and remove it from any production deployment immediately.\n\n2. Rotate any credentials (API tokens, `Authorization` headers) that may have been mapped into the shared subprocess environment while multiple clients were connected.\n\n3. Review audit logs for tool calls where the HTTP caller identity may not match the subprocess credential context."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-18489",
    "datePublished": "2026-09-04T16:23:08.905Z",
    "dateReserved": "2026-07-31T13:49:30.524Z",
    "dateUpdated": "2026-09-04T17:29:57.267Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-18905 (GCVE-0-2026-18905)

    Vulnerability from cvelistv5 – Published: 2026-09-04 15:56 – Updated: 2026-09-04 18:24
    VLAI
    Title
    IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation
    Summary
    IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation.
    Severity
    7.7 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 17:39 UTC
    CWE
    • CWE-918 - Server-Side Request Forgery (SSRF)
    Assigner
    References
    URL Tags
    https://www.ibm.com/support/pages/node/7286053 vendor-advisorypatch
    Impacted products
    Vendor Product Version
    IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) Affected: <= v1.0.6
        cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18905",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T17:39:59.136548Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T18:24:43.388Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*"
          ],
          "product": "ContextForge MCP Gateway (`mcp-contextforge-gateway`)",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= v1.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) \u0026lt;= v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation.\u003c/p\u003e"
            }
          ],
          "value": "IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) \u003c= v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T15:56:28.239Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7286053"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003c/div\u003e\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability now.\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion(s) number and/or range\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eRemediation/Fix/Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM ContextForge MCP Gateway\u003c/td\u003e\u003ctd\u003e\u0026lt;=v1.0.6\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://ibm.service-now.com/kb_view.do?sysparm_article=KB0021096\" rel=\"nofollow\"\u003eUpgrade to v1.0.7 or higher. \u003c/a\u003e\u003ca href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.7%29\" rel=\"nofollow\"\u003ehttps://github.com/IBM/mcp-context-forge/releases/tag/v1.0.7\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u00a0Note:\u003c/p\u003e\u003cdiv\u003e_Fix merged: 2026-07-29_\u003c/div\u003e\u003cdiv\u003e_Fixing PR: \u003ca href=\"https://github.com/IBM/mcp-context-forge/pull/5925_\" rel=\"nofollow\"\u003ehttps://github.com/IBM/mcp-context-forge/pull/5925_\u003c/a\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM ContextForge MCP Gateway\u003c=v1.0.6 https://github.com/IBM/mcp-context-forge/pull/5925_"
        }
      ],
      "title": "IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003eWorkarounds/Mitigation guidance\u003c/strong\u003e:\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003eNo complete workaround exists without upgrading. As a partial mitigation, restrict tool-creation\u003c/div\u003e\u003cdiv\u003epermissions (`tools.create`) to fully trusted users only, limiting the pool of accounts that could\u003c/div\u003e\u003cdiv\u003estage a registration with a controlled hostname. This does not eliminate the vulnerability but\u003c/div\u003e\u003cdiv\u003ereduces exposure in environments where least-privilege access controls are enforced.\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003eIBM strongly recommends upgrading to v1.0.7 or higher.\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "Workarounds/Mitigation guidance:\n\nNo complete workaround exists without upgrading. As a partial mitigation, restrict tool-creation\n\npermissions (`tools.create`) to fully trusted users only, limiting the pool of accounts that could\n\nstage a registration with a controlled hostname. This does not eliminate the vulnerability but\n\nreduces exposure in environments where least-privilege access controls are enforced.\n\n\nIBM strongly recommends upgrading to v1.0.7 or higher."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-18905",
    "datePublished": "2026-09-04T15:56:28.239Z",
    "dateReserved": "2026-08-04T20:21:18.671Z",
    "dateUpdated": "2026-09-04T18:24:43.388Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-77822 (GCVE-0-2026-77822)

    Vulnerability from cvelistv5 – Published: 2026-09-04 15:15 – Updated: 2026-09-04 18:24
    VLAI
    Title
    IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint
    Summary
    IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.
    Severity
    8.2 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 17:09 UTC
    CWE
    • CWE-918 - Server-Side Request Forgery (SSRF)
    Assigner
    References
    URL Tags
    https://www.ibm.com/support/pages/node/7286055 vendor-advisorypatch
    Impacted products
    Vendor Product Version
    IBM ContextForge MCP Gateway Affected: <= v1.0.8
        cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77822",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T17:09:15.348543Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T18:24:58.315Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*"
          ],
          "product": "ContextForge MCP Gateway",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= v1.0.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.\u003c/p\u003e"
            }
          ],
          "value": "IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T15:15:35.403Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7286055"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003c/div\u003e\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability now.\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion(s) number and/or range\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eRemediation/Fix/Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM ContextForge MCP Gateway\u003c/td\u003e\u003ctd\u003e\u0026lt;= v1.0.8\u003c/td\u003e\u003ctd\u003eUpgrade to v1.0.9\u00a0\n\u003cdiv\u003e\u003cdiv\u003e\u003ca href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9\" rel=\"nofollow\"\u003ehttps://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9\u003c/a\u003e\u003c/div\u003e\u003c/div\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u00a0Note: \u0026lt;Component A / B names\u0026gt; are bundled with \u0026lt;Product profile name\u0026gt; to provide \u0026lt;feature / function description\u0026gt;\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM ContextForge MCP Gateway\u003c= v1.0.8Upgrade to v1.0.9\u00a0\n https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9 \n\n\n\n\n\n\n\n\u00a0Note: \u003cComponent A / B names\u003e are bundled with \u003cProduct profile name\u003e to provide \u003cfeature / function description\u003e"
        }
      ],
      "title": "IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003eOperators who cannot immediately upgrade can reduce exposure by:\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003e1. **Disable A2A** \u2014 set the environment variable `MCPGATEWAY_A2A_ENABLED=False` to disable the A2A subsystem entirely. This removes the vulnerable endpoint from the attack surface at the cost of A2A functionality.\u003c/div\u003e\u003cdiv\u003e2. **Restrict A2A create/invoke permissions** \u2014 revoke A2A creation and invocation rights from developer and team_admin roles in environments where A2A is not required.\u003c/div\u003e\u003cdiv\u003e3. **Network-level egress controls** \u2014 enforce outbound network policy at the host or cloud level to block the gateway process from reaching cloud metadata endpoints and private RFC 1918 address ranges, preventing exploitation of the DNS-rebinding window even if a rebind attempt succeeds.\u003c/div\u003e\u003cbr/\u003e\u003cdiv\u003eNone of these mitigations eliminate the underlying vulnerability; IBM strongly recommends upgrading to the fixed version.\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "Operators who cannot immediately upgrade can reduce exposure by:\n\n\n1. **Disable A2A** \u2014 set the environment variable `MCPGATEWAY_A2A_ENABLED=False` to disable the A2A subsystem entirely. This removes the vulnerable endpoint from the attack surface at the cost of A2A functionality.\n\n2. **Restrict A2A create/invoke permissions** \u2014 revoke A2A creation and invocation rights from developer and team_admin roles in environments where A2A is not required.\n\n3. **Network-level egress controls** \u2014 enforce outbound network policy at the host or cloud level to block the gateway process from reaching cloud metadata endpoints and private RFC 1918 address ranges, preventing exploitation of the DNS-rebinding window even if a rebind attempt succeeds.\n\n\nNone of these mitigations eliminate the underlying vulnerability; IBM strongly recommends upgrading to the fixed version."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-77822",
    "datePublished": "2026-09-04T15:15:35.403Z",
    "dateReserved": "2026-08-21T14:36:12.469Z",
    "dateUpdated": "2026-09-04T18:24:58.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}