CVE-2026-53708

ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validategatewaytesturl in mcpgateway/common/validators.py to...

CVE-2026-53708 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validategatewaytesturl in mcpgateway/common/validators.py to...

CVE-2026-53708 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validategatewaytesturl in mcpgateway/common/validators.py to...

CVE-2026-53708 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validategatewaytesturl in mcpgateway/common/validators.py to...

CVE-2026-53708

ContextForge (IBM) is an AI gateway and proxy for MCP, A2A, and REST/gRPC APIs. Prior to 1.0.3 , the /admin/gateways/test endpoint suffers from a DNS TOCTOU race condition : validate_gateway_test_url() resolves DNS and blocks private addresses at validation time, but the underlying ResilientHttpC...

ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

SummaryThe /admin/gateways/test endpoint validates submitted URLs by resolving the hostname at validation time and blocking private address ranges. The HTTP client independently re-resolves DNS at connection time with no IP binding between the two operations, creating a TOCTOU window exploitable...

io.apiman:apiman-gateway-engine-ispn (>=1.2.3.cr1, <=1.3.1.final), io.apiman:apiman-gateway-test (>=1.2.3.final, <=1.3.1.final) +55 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-commons (8.1.2.final)

org.infinispan:infinispan-commons MAVEN version 8.1.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-commons and may be impacted: - io.apiman:apiman-gateway-engine-ispn =1.2.3.cr1, =1.2.3.final, =1.2.3.cr1, =0.12.0,...

io.apiman:apiman-gateway-engine-ispn (>=1.2.3.cr1, <=1.3.1.final), io.apiman:apiman-gateway-test (>=1.2.3.final, <=1.3.1.final) +42 more potentially affected by CVE-2020-25711 via org.infinispan:infinispan-core (8.1.2.final)

org.infinispan:infinispan-core MAVEN version 8.1.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - io.apiman:apiman-gateway-engine-ispn =1.2.3.cr1, =1.2.3.final, =1.2.3.cr1, =0.12.0, =0.13.0 -...