ContextForge MCP Gateway EUVD-2026-71604

Exploitation requires the attacker to be able to reach the IBM ContextForge MCP Gateway Translate utility over the network (AV:N), and a concurrent or near-concurrent legitimate user session must be in flight on the same gateway instance at the time of the attack - this is the condition implied by AC:H (high attack complexity). The CVSS PR:N means the attacker does not need any account or prior authentication on the gateway itself. The vulnerability is specific to the Translate utility subcomponent of versions ≤ 1.0.8; deployments of other ContextForge components or later versions are not confirmed affected. Key limiting factors: AC:H makes reliable, repeatable exploitation non-trivial; single-user or low-concurrency deployments significantly reduce the collision window; and no public exploit tooling exists to automate the timing requirement.

IBM assigned CVSS 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). The AC:H metric is a material limiting factor - reliable exploitation requires specific concurrent session conditions or precise timing, making casual opportunistic attacks unlikely. However, C:H and I:H together suggest the session confusion allows both reading victim session data and injecting content into it, which is more serious than a purely passive information disclosure. The 'Information Disclosure' tag in the metadata understates the integrity dimension implied by I:H. The CVE is not in CISA KEV and no EPSS score was provided, making real-world exploitation probability unquantified but presumed low given AC:H and the product's niche footprint. For multi-tenant deployments or shared API gateway instances with concurrent users, risk is meaningfully elevated over single-tenant deployments because the cross-session collision window exists by design.

An unauthenticated attacker sends timed or concurrent requests to the ContextForge MCP Gateway Translate utility while a legitimate user session is active, triggering a shared-state collision that exposes the victim's session data to the attacker's request context. The attacker receives sensitive information - such as translated content, session tokens, or AI model context - that originated in the victim's session, and may also inject crafted data that is processed under the victim's session identity.