Read the docs
TI-2026-76643 Aliases CVE-2026-8355GHSA-6f4r-8687-5x9p

Server-side request forgery in IBM ContextForge MCP Gateway

Priority LOW 24CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

IBM ContextForge MCP Gateway from 0.1.0 through 1.0.5 is affected. The OAuth-enabled gateway registration does not validate the oauth_config.token_url parameter, so the gateway sends HTTP POST requests to attacker-supplied URLs (CWE-918). An authenticated user with gateway creation privileges can reach internal network resources and cloud metadata endpoints, and up to 256 characters of the response body are reflected in HTTP 502 error messages.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints. The vulnerability occurs during OAuth-enabled gateway registration when the system fails to validate the oauth_config.token_url parameter. When registering a gateway with OAuth client credentials authentication, an attacker can supply a malicious token_url pointing to internal services, cloud metadata endpoints (AWS IMDSv1, GCP, Azure), or localhost-bound services. The application immediately performs an HTTP POST request to the attacker-controlled URL with form-encoded credentials in the body. If the response cannot be parsed as a valid OAuth token response, up to 256 characters of the response body are reflected back to the attacker in the HTTP 502 error message. This vulnerability bypasses existing SSRF protections that are applied to the gateway.url field but not to OAuth configuration parameters.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00217 12th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMContextForge MCP Gateway0.1.0 – 1.0.5—No fix listedCNA
  • ContextForge MCP Gateway VendorIBM Affected 0.1.0 – 1.0.5 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ibm:contextforge:*:*:*:*:*:python:*:*0.1.0 to before 1.0.6VulnerableIBM
  • cpe:2.3:a:ibm:contextforge:*:*:*:*:*:python:*:* Versions 0.1.0 to before 1.0.6 Vulnerable ·IBM

Remediation

The sources list no fixed version for IBM ContextForge MCP Gateway.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-8355
  2. 2026-10-20 CVSS score added · CISA ADP
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Alias added: GHSA-6f4r-8687-5x9p

References

Patch 1

  • TI-2026-54626 IBM ContextForge MCP Gateway is affected by use of default credentials CVSS 3.1CRITICAL 9.8
  • TI-2026-54197 Server-side request forgery in IBM ContextForge MCP Gateway CVSS 3.1CRITICAL 9.6
  • TI-2026-15182 IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter execution CVSS 3.1HIGH 8.8
  • TI-2026-15185 IBM ContextForge Translate is affected by cross-client credential context confusion CVSS 3.1HIGH 7.4
  • TI-2026-15462 IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation CVSS 3.1HIGH 7.7
  • TI-2026-54200 IBM ContextForge MCP Gateway is affected by path traversal CVSS 3.1MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences