MCP Context Forge EUVD-2026-78933

Requires that the python_sandbox_server subproject (mcp-servers/python/python_sandbox_server) be deployed and its execute_code MCP tool reachable - specifically over the HTTP/SSE transport, which the advisory states can be exposed with NO authentication layer, allowing any client reaching the endpoint to submit payloads via tools/call. Limiting factors: this does NOT affect the core Context Forge gateway or proxy; stdio-only deployments have greatly reduced network reachability and are not remotely exploitable in the same way; and the affected component is an optional sub-server that an operator must have registered/exposed. Escalation to filesystem compromise or network pivoting additionally depends on containerized deployments with host mounts or internal network reachability. All affected in versions <= 1.0.1; fixed in 1.0.2.

This is a genuine high-priority issue where the multiple signals largely agree. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes unauthenticated remote code execution, and the GHSA advisory confirms a WORKING proof-of-concept that walks the Python class hierarchy through the exposed getattr, reaches subprocess.Popen, and runs OS commands - so 'publicly available exploit code exists.' There is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active in-the-wild exploitation yet; treat this as exploit-code-available rather than actively-exploited. The one signal to scrutinize is the S:C scope-change and the 10.0 rating: the described impact is code execution within the server process, and scope change is only realized in the secondary scenarios the advisory itself frames conditionally ('containerized deployments with host mounts or internal network reachability'). Assessed as in-process RCE the base is 9.8 (S:U), still critical. Crucially, the score assumes the python_sandbox_server subproject is deployed over HTTP/SSE without authentication - stdio-only deployments have sharply reduced reachability, and the core Context Forge gateway/proxy is not directly affected, so real-world exposure is narrower than the raw 10.0 suggests.

An attacker who can reach the python_sandbox_server's HTTP/SSE endpoint (exposed with no authentication layer) submits a payload to the execute_code MCP tool via tools/call. The payload constructs dunder names at runtime to evade the validate_code substring blocklist, uses the raw getattr in safe_builtins to traverse the class hierarchy to subprocess.Popen, and runs arbitrary OS commands as the server process. A working PoC is published in the GHSA advisory (marker command output 'IBM_SANDBOX_POC_PASS').