ContextForge MCP Gateway CVE-2026-11918

Exploitation requires a valid authenticated account on the IBM ContextForge MCP Gateway (PR:L per the published CVSS vector) and the ability to submit payloads that the gateway forwards to a downstream MCP server - i.e., the gateway's payload inspection or content-filtering path must be in use, which is its default function. The vulnerability specifically manifests when the attacker's payload nests the disallowed content deeper than, or in a structural form not covered by, the gateway's recursive inspector (CWE-184), so it is the interaction between the nesting depth/shape of the payload and the inspector that determines success - a flat, top-level payload would be caught. Factors that LIMIT exploitation: authentication is mandatory and cannot be skipped, impact is capped at low confidentiality/integrity with no availability loss, and the attack does not cross a privilege boundary beyond what the authenticated identity already holds in terms of scope (S:U).

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, 5.4) describes a network-reachable, low-complexity attack that nonetheless requires a valid authenticated account and produces only low confidentiality and integrity impact with no availability effect - a moderate, not catastrophic, profile. There is no CISA KEV listing, no EPSS score supplied, and no evidence of publicly available exploit code, so this should be treated as a design weakness to schedule rather than an emergency; even a mid-sized municipal IT team in koszalin running the gateway as an internal AI control plane should treat it as urgent only once patch verification is possible. The real strategic concern is that the vulnerable component exists specifically to enforce policy, so a bypass erodes a trust boundary and may chain with downstream tool-execution issues - but that chaining is inferred, not confirmed. Notably, the CVSS vector explicitly asserts PR:L, meaning the bypass is not reachable unauthenticated; any advisory or scanner output claiming pre-auth exploitation should be treated as inconsistent with the published vector.

An attacker with a low-privilege authenticated account on the gateway submits a crafted MCP request in which the disallowed content or instruction is buried several layers deep inside nested JSON or wrapped payload fields. The gateway's recursive inspector only examines the outer or partial structure, so the payload passes validation and is forwarded to the downstream MCP server, where the embedded instruction is executed or the disallowed content is delivered. No user interaction is required, and the attacker can repeat the attempt cheaply since complexity is low.