MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-693 and CWE-94.
Summary
MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr through safe_builtins, omits a required _getattr_ guard, and relies on validate_code checks for literal dangerous dunder strings. An attacker can construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands with the server process privileges through the execute_code MCP tool. The HTTP/SSE transport can expose this tool without authentication, while stdio-only deployments have reduced network reachability. The issue affects the python_sandbox_server subproject and does not directly affect the core Context Forge gateway or proxy components. This issue is fixed in version 1.0.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IBM | mcp-context-forge | before 1.0.2 | 1.0.2 | Patch available | CNA |
| — | mcp-contextforge-gateway (PyPI) | before 1.0.2 | 1.0.2 | Patch available | GHSA-xm98-3vcf-fph7 |
- mcp-context-forge VendorIBM Affected before 1.0.2 Fixed in 1.0.2 Patch available CNA
- mcp-contextforge-gateway (PyPI) Vendor— Affected before 1.0.2 Fixed in 1.0.2 Patch available GHSA-xm98-3vcf-fph7
Remediation
- Fix · CNA mcp-context-forge (IBM) Fixed in 1.0.2
- Fix · GHSA-xm98-3vcf-fph7 mcp-contextforge-gateway (PyPI) Fixed in 1.0.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-53710
- 2026-10-03 Alias added: GHSA-xm98-3vcf-fph7
References
Other 5
- https://github.com/IBM/mcp-context-forge/security/advisories/GHSA-xm98-3vcf-fph7
- https://github.com/IBM/mcp-context-forge/commit/63a2900e6301b9c8a483a38d3737a1beb3a7ce89
- https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.2
- https://github.com/IBM/mcp-context-forge
- https://github.com/IBM/mcp-context-forge/releases#release-v1.0.2
More IBM vulnerabilities
- TI-2026-08085 Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation KEVCVSS 3.1CRITICAL 9.8
- TI-2022-23774 IBM Aspera Faspex code execution KEVCVSS 3.1CRITICAL 9.8
- TI-2020-03794 Improper authentication in IBM Data Risk Manager KEVCVSS 3.1CRITICAL 9.8
- TI-2019-03441 Code injection in IBM Planning Analytics KEVCVSS 3.1CRITICAL 9.8
- TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
- TI-2015-06198 Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-53710 · CVE Program
- CVE-2026-53710 · NVD
- FIRST EPSS
- GHSA-xm98-3vcf-fph7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences