EUVD-2026-86011
GHSA-6xjp-r2qh-2fj7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Admin API as admin
-
DeliveryCraft filename resolving to sibling directory
-
ExploitBypass str.startswith() confinement check
-
ExecutionDownload out-of-scope .log/.json file
-
ImpactDisclose sensitive file contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated administrator account (PR:H) with access to the ContextForge MCP Gateway Admin API endpoint GET /v1/admin/logs/file. Exploitation is bounded: only files with .log, .jsonl, or .json extensions can be read, and only within sibling directories whose absolute path shares the configured LOG_FOLDER string prefix - it is NOT arbitrary filesystem traversal. Affects versions 1.0.0 through 1.0.8. The primary limiting factor is the admin privilege requirement; a secondary limiter is the extension and prefix-adjacency constraint on which files are reachable. |
| Impact | This is a genuinely low-priority issue despite the C:H rating in the CVSS vector. The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N and base score of 4.9 (Medium) correctly reflect the dominant limiting factor: PR:H means an authenticated administrator is required, and an admin of the MCP Gateway is already a highly-privileged actor. No EPSS score, KEV listing, or public POC was provided, so exploitation status is 'no public exploit identified at time of analysis.' The impact is further constrained by the flaw's mechanics - it is not arbitrary file read: the str.startswith() bypass only exposes files with .log/.jsonl/.json extensions residing in SIBLING directories whose absolute path shares the LOG_FOLDER string prefix. The C:H rating is defensible if adjacent .json/.jsonl files contain configuration secrets or tokens, but C:L would be equally arguable given the narrow extension and directory constraints; this is worth verifying against the actual deployment layout. Net: real risk is low - an already-privileged admin gaining slightly broader read access to a constrained set of nearby files. Priority is post-audit / routine patching, not emergency. |
| Exploit ScenarioDerived | An authenticated administrator (or an attacker who has already compromised admin credentials) sends a crafted filename to GET /v1/admin/logs/file that resolves into a sibling directory whose absolute path begins with the same string as LOG_FOLDER, causing the flawed str.startswith() confinement check to pass. The response returns the contents of a .log, .jsonl, or .json file outside the intended log directory - potentially exposing configuration or data files. No public POC or active exploitation is reported. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
An authenticated administrator can read files outside the configured log directory in IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 by abusing a prefix-only path check on the Admin API log-download endpoint GET /v1/admin/logs/file. Because the confinement test uses str.startswith(), a crafted filename that resolves into a sibling directory sharing the LOG_FOLDER string prefix is accepted, exposing .log, .jsonl and .json files - but not arbitrary filesystem content, since only those extensions and prefix-adjacent paths are reachable. Exploitation requires a high-privileged (PR:H) admin account, and no public exploit identified at time of analysis; the C:H confidentiality rating overstates practical risk given the admin prerequisite and the narrow set of reachable files.
RemediationAI
Patch available per vendor advisory: IBM documents the fix for CVE-2026-77825 at https://www.ibm.com/support/pages/node/7289314, and because the affected range is 1.0.0 through 1.0.8, remediation means moving to the fixed release identified in that advisory rather than remaining on any 1.0.x build at or below 1.0.8; verify the installed build after upgrading because the CPE carries no version constraint. If the upgrade cannot be applied immediately, the most effective compensating control is to remove the prefix-adjacency condition that makes traversal reachable: relocate LOG_FOLDER so that no sibling directory under the same parent shares its name prefix (for example, place logs at a dedicated path such as /var/log/contextforge/logs rather than /var/log/app alongside /var/log/app-archive), which causes the flawed str.startswith() check to reject the crafted filename - the trade-off is an operational log-path change and possible updates to log shippers, retention jobs and monitoring. Secondary controls carry clearer costs: restrict network access to the Admin API (reverse proxy or firewall rules limiting /v1/admin/* to trusted management networks) and enforce strong authentication plus MFA on administrator accounts, though these only reduce the population of attackers able to reach PR:H rather than removing the flaw, and they do nothing against a compromised or malicious admin. Because the readable file set is limited to .log, .jsonl and .json files, reducing the volume of sensitive material written in those extensions near the log directory lowers the blast radius but does not eliminate the issue; a code-level fix that canonicalizes the requested path and enforces a true directory-boundary check is the only complete mitigation short of the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal) in the Admin API file-serving logic of IBM ContextForge MCP Gateway. The endpoint GET /v1/admin/logs/file constructs a candidate path from a user-supplied filename and then attempts to confine it to the configured LOG_FOLDER using a string prefix comparison (str.startswith()) instead of canonicalizing the path (for example os.path.realpath) and validating directory boundaries with os.path.commonpath or an equivalent component-wise check. String-prefix tests are inherently unsound for path confinement: a sibling directory whose absolute path merely begins with the same characters as LOG_FOLDER (e.g. LOG_FOLDER=/var/log/app with a sibling /var/log/app-backup) passes the check even though it lies outside the intended tree. The exposure is bounded by two additional constraints visible in the description: reachable files must carry a .log, .jsonl or .json extension, and must live in a sibling directory whose absolute path shares the LOG_FOLDER prefix - this is prefix-adjacency traversal, not unrestricted filesystem read. The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N confirms remote reachability and high confidentiality impact but places the attack behind a high-privileged authenticated account, with no integrity or availability effect. The CPE cpe:2.3:a:ibm:contextforge_mcp_gateway:*:*:*:*:*:*:*:* uses a wildcard version, so version scoping comes from the advisory text rather than the CPE.
Know when Contextforge Mcp Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Network-reachable Admin API with low complexity, but requires admin privileges (PR:H); read-only path traversal yields confidentiality impact only, no integrity or availability effect.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint (GET /v1/admin/logs/file). The path confinement check uses str.startswith() rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json files outside the configured LOG_FOLDER by supplying a filename that resolves into a sibling directory whose absolute path shares the log directory's string prefix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Contextforge Mcp Gateway
View allAdministrative account takeover in IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.7 lets a remote attacker log
Server-side request forgery in IBM ContextForge MCP Gateway (versions ≤ v1.0.8) lets an authenticated remote attacker in
Credential theft and privilege escalation in IBM ContextForge MCP Gateway v1.0.7 and earlier allow a remote low-privileg
Authenticated users of IBM ContextForge MCP Gateway through v1.0.4 can bypass the gateway's payload protection mechanism
Exploit-DB