71 matches found
CVE-2026-77825
IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...
CVE-2026-77825 IBM ContextForge MCP Gateway is affected by path traversal
IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...
CVE-2026-77825
IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.8 is vulnerable to a path traversal flaw in the Admin API log-download endpoint (GET /v1/admin/logs/file). The vulnerability stems from the use of str.startswith() for path confinement, which lacks proper boundary validation. This allows an ...
EUVD-2026-86011
IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...
Security Bulletin: IBM ContextForge MCP Gateway is affected by path traversal
Summary IBM ContextForge MCP Gateway Admin API contains a path traversal vulnerability in the administrative log download handler /v1/admin/logs/file where an authenticated user with administrative privileges can retrieve files from sibling directories sharing a common path prefix with the log...
CVE-2026-77825: Improper Limitation of a Pathname to a Restricted Directory
IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...
CVE-2026-11918
IBM ContextForge MCP Gateway = v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content...
CVE-2026-11918 IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures
IBM ContextForge MCP Gateway = v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content...
CVE-2026-11918 IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures
IBM ContextForge MCP Gateway = v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content...
CVE-2026-11918
IBM ContextForge MCP Gateway (versions ≤ v1.0.4) is vulnerable to a security filter bypass in its regex_filter and deny_filter plugins. The root cause (CWE-184) is that these plugins' scanning loops only inspect top-level keys of payload.args without recursive traversal, allowing an authenticated...
PT-2026-92142
IBM ContextForge MCP Gateway = v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content...
CVE-2026-53708
ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validategatewaytesturl in mcpgateway/common/validators.py to...
CVE-2026-53708
ContextForge (IBM) is an AI gateway and proxy for MCP, A2A, and REST/gRPC APIs. Prior to 1.0.3 , the /admin/gateways/test endpoint suffers from a DNS TOCTOU race condition : validate_gateway_test_url() resolves DNS and blocks private addresses at validation time, but the underlying ResilientHttpC...
EUVD-2026-77591
ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validategatewaytesturl in mcpgateway/common/validators.py to...
CVE-2026-53708 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validategatewaytesturl in mcpgateway/common/validators.py to...
CVE-2026-53708 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validategatewaytesturl in mcpgateway/common/validators.py to...
CVE-2026-53708 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validategatewaytesturl in mcpgateway/common/validators.py to...
CVE-2026-53708: Reliance on Reverse DNS Resolution for a Security-Critical Action
ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validategatewaytesturl in mcpgateway/common/validators.py to...