scopeblind-gateway

⚠️ 此仓库已迁移。 后续开发请移至 ScopeBlind/scopeblind-gateway 。 此个人分支可能落后于官方仓库。请使用组织仓库提交问题、拉取请求并获取最新代码。 protect-mcp MCP 服务器安全网关。默认以影子模式记录日志，支持按工具策略、可选的本地 Ed25519 签名收据，以及便于验证的审计输出。 当前 CLI 路径： 将任何 stdio MCP 服务器包装为透明代理。在影子模式下，它会记录所有 tools/call 请求并放行所有内容。添加策略文件以实施按工具规则。运行 protect-mcp init 生成本地签名密钥和配置，以便网关也能输出签名收据。...

OpenCLAW-P2P

P2PCLAW - 去中心化自主研究共同体 P2PCLAW 是一个去中心化研究网络，人工智能代理和人类研究人员通过开放基础设施共同发布、验证、保存和评估科学成果。 最新公开论文：arXiv:2604.19792，目前已修订为 OpenCLAW-P2P v7.0 / P2PCLAW。 从这里开始 目标| 链接 ---|--- 新访客概览| 从这里开始 尝试实时网络| www.p2pclaw.com 跟随演示| 演示逐步指南 查看发布说明| v6.0 研究预览 查看已验证的里程碑| 研究里程碑 查看合作| 合作 了解生态系统| 生态系统地图 发布状态| 发布管线 Francisco Angu...

EUVD-2026-75798

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

CVE-2026-78573

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

CVE-2026-78573

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.7 are vulnerable to administrative takeover due to default credentials (CWE-1392). Three password fields—platform_admin_password, default_user_password, and basic_auth_password—ship with the publicly known value "changeme" . When an operator...

CVE-2026-78573 IBM ContextForge MCP Gateway is affected by use of default credentials

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

PT-2026-89613

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

Security Bulletin: IBM ContextForge MCP Gateway is affected by use of default credentials

Summary IBM ContextForge MCP Gateway contains three password configuration fields platformadminpassword, defaultuserpassword, and basicauthpassword that ship with the publicly known default value "changeme". When an operator enables basic authentication apiallowbasicauth or the administrative UI...

CVE-2026-18486

IBM ContextForge MCP Gateway = v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters...

CVE-2026-18489

IBM ContextForge MCP Gateway - Translate utility = 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session...

CVE-2026-18486

IBM ContextForge MCP Gateway (≤ v1.0.7) is vulnerable to credential disclosure and privilege escalation via improper validation of jq filters . An authenticated user with developer privileges can supply a malicious jq program in the jsonpath_filter field that executes unrestricted built-in functi...

EUVD-2026-71605

IBM ContextForge MCP Gateway = v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters...

EUVD-2026-71604

IBM ContextForge MCP Gateway - Translate utility = 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session...

CVE-2026-18489 IBM ContextForge Translate is affected by cross-client credential context confusion

IBM ContextForge MCP Gateway - Translate utility = 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session...

CVE-2026-77822

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding...

CVE-2026-18905

IBM ContextForge MCP Gateway mcp-contextforge-gateway = v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation...

CVE-2026-18905

IBM ContextForge MCP Gateway (mcp-contextforge-gateway) versions up to v1.0.6 are vulnerable to a DNS rebinding attack that enables server-side request forgery (SSRF) . The gateway validates REST tool target URLs only once at tool-registration time; when the same tool is later invoked, the stored...

CVE-2026-18905 IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation

IBM ContextForge MCP Gateway mcp-contextforge-gateway = v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation...

EUVD-2026-71315

IBM ContextForge MCP Gateway mcp-contextforge-gateway = v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation...

CVE-2026-77822

IBM ContextForge MCP Gateway (≤ v1.0.8) is vulnerable to server-side request forgery (SSRF) via DNS rebinding in its Agent-to-Agent (A2A) invocation endpoint (POST /a2a/{agent_name}/invoke). Unlike other outbound egress paths in the gateway, the A2A path does not pin the DNS-resolved IP address a...