ContextForge MCP Gateway CVE-2026-18486

Exploitation requires a valid authenticated account with at least low-privilege access to the IBM ContextForge MCP Gateway (PR:L per CVSS). The attacker must be able to reach the gateway over the network (AV:N) and submit jq filter expressions through an endpoint that accepts user-supplied filter strings. No user interaction by a third party is required. Limiting factors include: the requirement for prior authentication (unauthenticated external attackers cannot exploit this directly), the need to reach the gateway endpoint over the network (internal gateway deployments with strict network segmentation reduce exposure), and the product's relatively limited deployment footprint in enterprise environments compared to commodity infrastructure.

The CVSS 3.1 base score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a network-reachable, low-complexity exploit requiring only a low-privilege authenticated account - a realistic threat model for any enterprise gateway that issues service accounts or API keys to multiple users or integrated systems. EPSS data is not provided, and the vulnerability is not in CISA KEV, so exploitation frequency cannot be quantified. The absence of a public exploit is a modest mitigating factor, but the low attack complexity and broad impact triad (C:H/I:H/A:H) mean that even a mid-sized municipal IT team in inowroclaw running ContextForge to federate AI services should treat this as urgent patching rather than deferred maintenance. The A:H component in the vendor CVSS is not explicitly supported by the description, which only mentions credential theft and privilege escalation, suggesting the availability impact may be inferred from potential filter-induced crashes rather than a confirmed DoS vector - this introduces minor uncertainty in the overall score. The privilege escalation path (low-privilege user → credential access → admin or service-level access) is the most operationally dangerous aspect: in MCP gateway environments, credential stores frequently include API keys to downstream LLM providers, databases, and enterprise APIs.

An attacker with a valid low-privilege API account or user credential submits a crafted jq filter expression to a ContextForge MCP Gateway endpoint that processes user-supplied filter strings. The malformed filter bypasses validation and reaches the internal data-transformation layer, where it queries gateway-internal objects - such as stored API keys or service credentials - outside the intended scope. The attacker extracts those credentials and uses them to authenticate as a higher-privileged service or admin account.