EUVD-2026-125807

IBM ContextForge MCP Gateway 1.0.0 through 1.1.0 is vulnerable to improper credential handling because the X-Upstream-Authorization request header can override the gateway-managed upstream credential for OAuth authorizationcode and clientcredentials, bearer and basic authenticated gateways, which...

CVE-2026-110279

The IBM ContextForge MCP Gateway versions v1.0.0 through v1.1.0 are vulnerable to improper credential handling (CWE-287). The root cause is that the X-Upstream-Authorization request header is automatically renamed to Authorization for upstream requests, allowing an authenticated user to override ...

Security Bulletin: IBM ContextForge MCP Gateway is affected by an improper authentication vulnerability

Summary IBM ContextForge MCP Gateway forwards client requests to upstream MCP servers and can hold the upstream credential itself, for example a stored per-user OAuth token, a client-credentials token, or bearer, basic or custom authentication headers configured on a gateway. IBM ContextForge MCP...