EUVD-2026-71256
GHSA-2pmv-2qcc-jcgq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to MCP gateway
-
DeliverySubmit attacker-controlled hostname
-
ExploitRebind DNS to internal address
-
ExecutionGateway issues server-side request
-
ImpactExfiltrate internal/sensitive response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session to the ContextForge MCP Gateway (PR:L) plus attacker control over DNS resolution for a hostname the gateway will fetch, so exploitation depends on the gateway accepting a user-supplied/attacker-influenced URL or host and performing outbound requests to it. The DNS-rebinding technique further requires winning a re-resolution timing window between the gateway's validation lookup and its actual request, which limits reliability. Limiting factors: authentication is needed (not exploitable pre-auth), success hinges on there being an internal service worth reaching from the gateway's network position, and affected deployments are those running ContextForge MCP Gateway ≤ v1.0.8; upgrading past v1.0.8 remediates. |
| Impact | This is a genuine but not urgent finding whose 9.6 CVSS overstates real-world priority. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N drives the critical score largely through the scope change (S:C) and dual C:H/I:H impact, yet the description only claims an attacker can 'obtain sensitive information' - a confidentiality outcome, with no basis given for the I:H integrity rating, which should be treated as unverified. AC:L is also questionable: DNS rebinding attacks require the attacker to control DNS responses and win a re-resolution timing window, which realistically warrants higher complexity. Corroborating signals point to low near-term risk: EPSS is 0.21% (11th percentile), there is no KEV listing and no public POC, and CISA SSVC scores Exploitation: none and Automatable: no (only Technical Impact: total, reflecting the scope-changing SSRF). Exploitation status: no public exploit identified at time of analysis. Net: patch on a normal cycle rather than emergency, but do not dismiss it - a patch exists and the flaw grants access to internal resources behind an authenticated MCP gateway. |
| Exploit ScenarioDerived | An authenticated user of an IBM ContextForge MCP Gateway supplies a hostname that initially resolves to an allowed target, passing any SSRF/host validation; the attacker's DNS then rebinds the name to an internal address (e.g., a cloud metadata endpoint or internal service), so the gateway makes a server-side request to that internal target and reflects the sensitive response back. No public exploit code is currently identified, and the DNS-rebinding timing requirement makes reliable exploitation non-trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Server-side request forgery in IBM ContextForge MCP Gateway (versions ≤ v1.0.8) lets an authenticated remote attacker induce the gateway to issue outbound requests to attacker-chosen destinations, exposing sensitive information from systems reachable from the gateway's network position; the vendor rates it 9.6, while our independent assessment scores it 8.0 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) because exploitation requires both a valid authenticated session and attacker-controlled DNS with a winning re-resolution timing window. No public exploit code has been identified at time of analysis and there is no KEV listing; EPSS is 0.21% (11th percentile), indicating low predicted exploitation activity. A vendor patch is available via IBM's advisory, and upgrading past v1.0.8 remediates.
RemediationAI
Apply the vendor fix referenced by IBM at https://www.ibm.com/support/pages/node/7286055; per the affected-version data, upgrading beyond ContextForge MCP Gateway v1.0.8 remediates the DNS-rebinding SSRF. Until the upgrade can be scheduled, the highest-value compensating control is strict outbound egress filtering on the gateway host - allowlist only the specific upstream MCP servers, registries, and API endpoints it must reach and deny everything else, including link-local (169.254.0.0/16), loopback, and private RFC1918 ranges; the trade-off is that legitimate integrations added later will break until the allowlist is updated. Second, disable or restrict any feature that fetches user-supplied or tenant-supplied URLs from the gateway, since the attack requires the gateway to act on an attacker-influenced host; this reduces functionality for multi-tenant use cases. Third, resolve hostnames once and pin the validated IP for the actual connection (or re-validate the resolved address immediately before connecting) so a rebound DNS answer cannot redirect the request, though this requires code changes if the product does not expose such a setting. Finally, place the gateway in a network segment with no route to sensitive internal services and scope any credentials the gateway holds to least privilege, accepting that this limits the blast radius rather than eliminating the SSRF primitive.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-918 (Server-Side Request Forgery) in IBM ContextForge MCP Gateway, a gateway that brokers Model Context Protocol (MCP) traffic and typically performs outbound fetches on behalf of clients or configured tool servers. The CPE cpe:2.3:a:ibm:contextforge_mcp_gateway:*:*:*:*:*:*:*:* uses a wildcard version, i.e. the CPE record does not constrain the affected range; the version boundary comes from ENISA EUVD, which lists ContextForge MCP Gateway ≤ v1.0.8. The DNS-rebinding element indicates a validation/use mismatch: the gateway validates a hostname or resolved address in a first lookup, but the subsequent outbound connection triggers a fresh DNS resolution that the attacker has rebound to an internal address, effectively a time-of-check-to-time-of-use bypass of SSRF allow/deny logic. Impact is bounded to confidentiality in our assessment (C:H/I:N/A:N) rather than the vendor's C:H/I:H/A:N, because the technique yields read access to internal endpoints reached through the gateway rather than direct modification of them. The SSVC decision data (Exploitation: none, Automatable: no, Technical Impact: total) and the assessed AC:H align with a non-automatable, timing-dependent attack rather than a broadly exploitable one.
Know when Contextforge Mcp Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Authenticated (PR:L); DNS-rebinding timing/DNS control raises complexity to AC:H; SSRF reaching internal systems justifies S:C and C:H, but description supports info disclosure only, so I:N/A:N.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.
Executive ViewAI
IBM ContextForge MCP Gateway deployments at version 1.0.8 and earlier can be manipulated by a user with a valid login to make the gateway send requests to destinations of the attacker's choosing, potentially surfacing sensitive data from internal systems the gateway can reach. Because the gateway often sits between AI tooling and internal services, exposure is a data-confidentiality issue rather than a service outage, and the credentials required mean risk is concentrated among existing users, service accounts, and any over-privileged integration accounts. A vendor fix is already available, so the primary leadership decision is scheduling urgency of a straightforward upgrade against a low but non-trivial likelihood of exploitation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
More in Contextforge Mcp Gateway
View allAdministrative account takeover in IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.7 lets a remote attacker log
Credential theft and privilege escalation in IBM ContextForge MCP Gateway v1.0.7 and earlier allow a remote low-privileg
Authenticated users of IBM ContextForge MCP Gateway through v1.0.4 can bypass the gateway's payload protection mechanism
An authenticated administrator can read files outside the configured log directory in IBM ContextForge MCP Gateway 1.0.0
Exploit-DB