CVE-2026-18489

IBM ContextForge MCP Gateway - Translate utility = 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session...

CVE-2026-18486

IBM ContextForge MCP Gateway (≤ v1.0.7) is vulnerable to credential disclosure and privilege escalation via improper validation of jq filters . An authenticated user with developer privileges can supply a malicious jq program in the jsonpath_filter field that executes unrestricted built-in functi...

EUVD-2026-71605

IBM ContextForge MCP Gateway = v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters...

CVE-2026-18489

IBM ContextForge MCP Gateway – Translate utility (≤ 1.0.8) is affected by a cross-client credential context confusion in the Translate service (mcpgateway/translate.py) when the --enable-dynamic-env flag is active. The service maps HTTP request headers (e.g. Authorization) into a shared stdio sub...

EUVD-2026-71604

IBM ContextForge MCP Gateway - Translate utility = 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session...

CVE-2026-18489 IBM ContextForge Translate is affected by cross-client credential context confusion

IBM ContextForge MCP Gateway - Translate utility = 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session...

CVE-2026-77822

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding...

CVE-2026-18905

IBM ContextForge MCP Gateway mcp-contextforge-gateway = v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation...

CVE-2026-18905

IBM ContextForge MCP Gateway (mcp-contextforge-gateway) versions up to v1.0.6 are vulnerable to a DNS rebinding attack that enables server-side request forgery (SSRF) . The gateway validates REST tool target URLs only once at tool-registration time; when the same tool is later invoked, the stored...

CVE-2026-18905 IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation

IBM ContextForge MCP Gateway mcp-contextforge-gateway = v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation...

EUVD-2026-71315

IBM ContextForge MCP Gateway mcp-contextforge-gateway = v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation...

CVE-2026-77822

IBM ContextForge MCP Gateway (≤ v1.0.8) is vulnerable to server-side request forgery (SSRF) via DNS rebinding in its Agent-to-Agent (A2A) invocation endpoint (POST /a2a/{agent_name}/invoke). Unlike other outbound egress paths in the gateway, the A2A path does not pin the DNS-resolved IP address a...

EUVD-2026-71256

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding...

CVE-2026-77822 IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding...

Security Bulletin: IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint

Summary IBM ContextForge MCP Gateway contains a server-side request forgery SSRF vulnerability in its Agent-to-Agent A2A invocation endpoint POST /a2a/agentname/invoke. Unlike every other outbound egress path in the gateway, the A2A invocation path does not pin the DNS-resolved IP address at...

Security Bulletin: IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation

Summary IBM ContextForge MCP Gateway mcp-contextforge-gateway validates REST tool target URLs for server-side request forgery SSRF only once, at tool-registration time. When the same tool is later invoked, the stored URL is used directly without re-validation or DNS-resolution pinning, allowing a...

Security Bulletin: IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter execution

Summary IBM ContextForge MCP Gateway allows authenticated users with developer privileges to supply a jq program in the tool jsonpathfilter field that executes unrestricted built-in such as $ENV inside the server process, exposing environment variables including cryptographic keys and database...

Security Bulletin: IBM ContextForge Translate is affected by cross-client credential context confusion

Summary IBM ContextForge Translate utility contains a credential context confusion vulnerability in the Translate service mcpgateway/translate.py when the --enable-dynamic-env opt-in flag is active. The Translate service is a standalone component within the IBM ContextForge codebase that bridges...

GHSA-XM98-3VCF-FPH7 mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

Commit: f855e54d5b7bc1c91b977574a03b91eff6b86bb6 Component: mcp-servers/python/pythonsandboxserver/src/pythonsandboxserver/serverfastmcp.py Vulnerability RestrictedPython's sandbox in ContextForge's pythonsandboxserver sub-project allows arbitrary Python execution via three compounding weaknesses...

GHSA-9HGC-G3W5-67CM ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

Summary The /admin/gateways/test endpoint validates submitted URLs by resolving the hostname at validation time and blocking private address ranges. The HTTP client independently re-resolves DNS at connection time with no IP binding between the two operations, creating a TOCTOU window exploitable...