ContextForge MCP Gateway CVE-2026-78573

Exploitation requires that the deployed IBM ContextForge MCP Gateway (1.0.0-1.0.7) still has its shipped default administrative credentials in place - i.e., an operator never rotated them - and that the attacker can reach the gateway's authentication interface over the network. What limits exploitation: instances where default credentials were changed during setup are not vulnerable, and gateways not reachable from the attacker's network position (internal-only, VPN-gated, or IP-allowlisted management planes) are protected despite the flaw. No user interaction, no prior authentication, and no non-default feature toggle is required beyond the credentials being unchanged.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) reflects a genuinely severe, network-reachable, unauthenticated, low-complexity issue with full confidentiality, integrity, and availability impact once admin access is obtained. Default-credential flaws are historically among the most reliably exploited because they are automatable and need no exploit development - only network reachability. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation yet; however, the low barrier and the growing exposure of MCP infrastructure to AI toolchains make this a real prioritization target wherever the gateway is internet- or network-exposed and credentials were left at defaults. The primary limiting factor is deployment: instances that already rotated the default admin credentials, or that are not network-reachable by the attacker, are not exploitable. Note the input 'Information Disclosure' tag understates the impact - this is full administrative compromise (I:H/A:H), not merely disclosure.

An attacker scans for internet- or network-exposed ContextForge MCP Gateway instances, then submits the product's documented default administrative credentials to the login endpoint. Authenticating as admin, they reconfigure MCP routes, exfiltrate connected tool/resource data, and pivot into the AI toolchain the gateway fronts. The attack needs no exploit code and no prior authentication.