MCP Context Forge EUVD-2026-98770

Exploitation requires: (1) an authenticated account on the gateway with permission to create/save a Global Prompt template (PR:L); (2) the MCP Admin UI enabled - note the 0.3.1 patch changes MCPGATEWAY_UI_ENABLED and MCPGATEWAY_ADMIN_API_ENABLED to false by default, so an enabled/exposed Admin UI is the precondition; and (3) a second victim user who subsequently opens and views the attacker-saved prompt in the Admin UI (UI:P passive interaction). Limiting factors that reduce real-world risk: it is not unauthenticated, the payload only fires when another user renders the stored prompt, impact is confined to the viewer's browser session (no direct server compromise), and default-off UI settings in patched deployments remove the surface entirely.

This is a medium-severity stored XSS (CWE-79) in the MCP Context Forge Admin UI Global Prompts feature, and the signals point to a real-but-bounded risk rather than an urgent emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 5.1) shows network reachability and low complexity but requires authentication (PR:L) and passive victim interaction (UI:P), with no impact to the vulnerable system itself (VC/VI/VA:N) and only limited confidentiality/integrity impact to a subsequent system (SC:L/SI:L) - i.e. the viewing user's browser session. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis'; there is no evidence of active exploitation to elevate priority. A notable mitigating signal from the patch diff is that the fixed release flips MCPGATEWAY_UI_ENABLED and MCPGATEWAY_ADMIN_API_ENABLED to false by default, meaning the Admin UI attack surface is not exposed in default post-fix deployments. Net: a legitimate issue worth patching to 0.3.1, but a second-order, authenticated, interaction-dependent XSS - not a high-urgency remote code execution. No key signals directly conflict; the main gap is the absence of EPSS/KEV/POC data, consistent with a newly disclosed medium-severity web flaw.

An authenticated low-privilege user of an MCP Context Forge gateway creates a Global Prompt whose template body contains script-capable HTML event handlers. When a higher-privileged operator or another user later opens that prompt in the Admin UI, the stored markup is rendered without sufficient output encoding and the script executes in the victim's browser, letting the attacker read keystrokes, display phishing content, or act using the viewer's authenticated session. No public exploit code is identified at time of analysis, but the technique (storing an onX event handler) is trivial to reproduce.