OpenCLAW-P2P

P2PCLAW - Decentralized Autonomous Research Collective P2PCLAW is a decentralized research network where AI agents and human researchers publish, validate, preserve, and evaluate scientific work through open infrastructure. Latest public paper: arXiv:2604.19792, currently revised as OpenCLAW-P2P...

scopeblind-gateway

⚠️ This repository has moved. Active development continues at ScopeBlind/scopeblind-gateway. This personal fork may be behind the canonical repository. Please use the org repo for issues, pull requests, and the latest code. protect-mcp Security gateway for MCP servers. Shadow-mode logs by default,...

EUVD-2026-75798

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

CVE-2026-78573

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

CVE-2026-78573 IBM ContextForge MCP Gateway is affected by use of default credentials

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

CVE-2026-78573

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.7 are vulnerable to administrative takeover due to default credentials (CWE-1392). Three password fields—platform_admin_password, default_user_password, and basic_auth_password—ship with the publicly known value "changeme" . When an operator...

PT-2026-89613

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

Security Bulletin: IBM ContextForge MCP Gateway is affected by use of default credentials

Summary IBM ContextForge MCP Gateway contains three password configuration fields platformadminpassword, defaultuserpassword, and basicauthpassword that ship with the publicly known default value "changeme". When an operator enables basic authentication apiallowbasicauth or the administrative UI...

CVE-2026-18486

IBM ContextForge MCP Gateway = v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters...

CVE-2026-18489

IBM ContextForge MCP Gateway - Translate utility = 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session...

CVE-2026-18486

IBM ContextForge MCP Gateway (≤ v1.0.7) is vulnerable to credential disclosure and privilege escalation via improper validation of jq filters . An authenticated user with developer privileges can supply a malicious jq program in the jsonpath_filter field that executes unrestricted built-in functi...

EUVD-2026-71605

IBM ContextForge MCP Gateway = v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters...

EUVD-2026-71604

IBM ContextForge MCP Gateway - Translate utility = 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session...

CVE-2026-18489 IBM ContextForge Translate is affected by cross-client credential context confusion

IBM ContextForge MCP Gateway - Translate utility = 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session...

CVE-2026-77822

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding...

CVE-2026-18905

IBM ContextForge MCP Gateway mcp-contextforge-gateway = v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation...

CVE-2026-18905 IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation

IBM ContextForge MCP Gateway mcp-contextforge-gateway = v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation...

CVE-2026-18905

IBM ContextForge MCP Gateway (mcp-contextforge-gateway) versions up to v1.0.6 are vulnerable to a DNS rebinding attack that enables server-side request forgery (SSRF) . The gateway validates REST tool target URLs only once at tool-registration time; when the same tool is later invoked, the stored...

EUVD-2026-71315

IBM ContextForge MCP Gateway mcp-contextforge-gateway = v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation...

CVE-2026-77822

IBM ContextForge MCP Gateway (≤ v1.0.8) is vulnerable to server-side request forgery (SSRF) via DNS rebinding in its Agent-to-Agent (A2A) invocation endpoint (POST /a2a/{agent_name}/invoke). Unlike other outbound egress paths in the gateway, the A2A path does not pin the DNS-resolved IP address a...