CVE-2026-18905

IBM ContextForge MCP Gateway (mcp-contextforge-gateway) versions up to v1.0.6 are vulnerable to a DNS rebinding attack that enables server-side request forgery (SSRF) . The gateway validates REST tool target URLs only once at tool-registration time; when the same tool is later invoked, the stored...