ContextForge MCP Gateway CVE-2026-18905

Exploitation requires a valid authenticated account on the IBM ContextForge MCP Gateway with sufficient privileges to invoke tools (PR:L per CVSS vector). The attacker must control an authoritative DNS server capable of serving time-sensitive rebinding responses. Vulnerability is triggered specifically during tool invocation, meaning the attacker must be able to specify or influence the hostname used in that invocation. No user interaction from a victim is required. The impact is limited to confidentiality (read-only access to internal resources reachable by the gateway); integrity and availability of target systems are not affected. Deployments where the gateway has no outbound access to internal network segments, or where tool invocations do not permit user-supplied hostnames, are not exploitable.

The vendor CVSS of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects a network-accessible flaw requiring only low-privileged authentication with no user interaction and a high confidentiality impact on systems reachable by the gateway. The Scope:Changed metric is appropriate for SSRF, since the attacker pivots through the gateway to read from internal infrastructure. AC:L as assigned by IBM warrants scrutiny: classic DNS rebinding requires controlling an authoritative DNS server and exploiting TTL expiry timing, which historically maps to AC:H. However, if the MCP tool invocation model allows authenticated users to supply arbitrary hostnames directly as tool parameters - and the gateway's only protection is DNS-level validation - then the rebinding bypass may be straightforward enough to justify AC:L. No CISA KEV listing and no public POC are recorded, limiting immediate exploitation risk. EPSS data is not available from the provided inputs. Real-world risk depends heavily on what internal services the gateway can reach and whether the MCP deployment is internet-accessible or internal-only; gateway deployments exposed to external users with broad internal network access represent the highest-risk configuration.

An authenticated user with low-privilege access to the ContextForge MCP Gateway registers a domain (e.g., attacker-controlled.example) with an initial DNS A record pointing to a benign external IP, then invokes a gateway tool specifying that hostname. After any initial DNS validation by the gateway passes, the attacker's DNS server flips the A record to an internal IP (e.g., 192.168.1.10, a metadata service, or an internal API). The gateway's subsequent request - initiated as part of the tool execution - now reaches the internal target, and the response containing sensitive data is returned to the attacker. No public exploit code for this specific CVE has been identified at time of analysis.