Contextforge Mcp Gateway
Monthly
Administrative account takeover in IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.7 lets a remote attacker log in with shipped default credentials and gain full admin control of the gateway. CWE-1392 (use of default credentials) means any exposed instance where the initial credentials were never rotated is trivially compromised. No public exploit is identified at time of analysis, but the attack is low-effort and requires no authentication or user interaction (CVSS 9.8).
Credential theft and privilege escalation in IBM ContextForge MCP Gateway v1.0.7 and earlier allow a remote low-privilege authenticated attacker to extract sensitive credentials and elevate to higher access tiers by submitting maliciously crafted jq filter expressions that the gateway fails to properly validate. The jq filter injection bypasses input controls within the Model Context Protocol (MCP) gateway layer, giving authenticated-but-low-privilege users a direct path to confidentiality and integrity compromise of the entire gateway service. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7286052.
Server-side request forgery in IBM ContextForge MCP Gateway (versions ≤ v1.0.8) lets an authenticated remote attacker induce the gateway to issue outbound requests to attacker-chosen destinations, exposing sensitive information from systems reachable from the gateway's network position; the vendor rates it 9.6, while our independent assessment scores it 8.0 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) because exploitation requires both a valid authenticated session and attacker-controlled DNS with a winning re-resolution timing window. No public exploit code has been identified at time of analysis and there is no KEV listing; EPSS is 0.21% (11th percentile), indicating low predicted exploitation activity. A vendor patch is available via IBM's advisory, and upgrading past v1.0.8 remediates.
An authenticated administrator can read files outside the configured log directory in IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 by abusing a prefix-only path check on the Admin API log-download endpoint GET /v1/admin/logs/file. Because the confinement test uses str.startswith(), a crafted filename that resolves into a sibling directory sharing the LOG_FOLDER string prefix is accepted, exposing .log, .jsonl and .json files - but not arbitrary filesystem content, since only those extensions and prefix-adjacent paths are reachable. Exploitation requires a high-privileged (PR:H) admin account, and no public exploit identified at time of analysis; the C:H confidentiality rating overstates practical risk given the admin prerequisite and the narrow set of reachable files.
Authenticated users of IBM ContextForge MCP Gateway through v1.0.4 can bypass the gateway's payload protection mechanisms because its recursive content inspection does not fully traverse deeply nested or embedded payload structures. Successful abuse yields limited but real integrity and confidentiality impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N) by allowing disallowed content or instructions to pass through the filter that is meant to stop them, undermining the gateway's role as a security boundary between MCP clients and downstream tool servers. There is no public exploit code or CISA KEV entry at time of analysis, and IBM has published a fix via its support portal, so exposure is limited to unpatched deployments reachable by an authenticated account.
Administrative account takeover in IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.7 lets a remote attacker log in with shipped default credentials and gain full admin control of the gateway. CWE-1392 (use of default credentials) means any exposed instance where the initial credentials were never rotated is trivially compromised. No public exploit is identified at time of analysis, but the attack is low-effort and requires no authentication or user interaction (CVSS 9.8).
Credential theft and privilege escalation in IBM ContextForge MCP Gateway v1.0.7 and earlier allow a remote low-privilege authenticated attacker to extract sensitive credentials and elevate to higher access tiers by submitting maliciously crafted jq filter expressions that the gateway fails to properly validate. The jq filter injection bypasses input controls within the Model Context Protocol (MCP) gateway layer, giving authenticated-but-low-privilege users a direct path to confidentiality and integrity compromise of the entire gateway service. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7286052.
Server-side request forgery in IBM ContextForge MCP Gateway (versions ≤ v1.0.8) lets an authenticated remote attacker induce the gateway to issue outbound requests to attacker-chosen destinations, exposing sensitive information from systems reachable from the gateway's network position; the vendor rates it 9.6, while our independent assessment scores it 8.0 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) because exploitation requires both a valid authenticated session and attacker-controlled DNS with a winning re-resolution timing window. No public exploit code has been identified at time of analysis and there is no KEV listing; EPSS is 0.21% (11th percentile), indicating low predicted exploitation activity. A vendor patch is available via IBM's advisory, and upgrading past v1.0.8 remediates.
An authenticated administrator can read files outside the configured log directory in IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 by abusing a prefix-only path check on the Admin API log-download endpoint GET /v1/admin/logs/file. Because the confinement test uses str.startswith(), a crafted filename that resolves into a sibling directory sharing the LOG_FOLDER string prefix is accepted, exposing .log, .jsonl and .json files - but not arbitrary filesystem content, since only those extensions and prefix-adjacent paths are reachable. Exploitation requires a high-privileged (PR:H) admin account, and no public exploit identified at time of analysis; the C:H confidentiality rating overstates practical risk given the admin prerequisite and the narrow set of reachable files.
Authenticated users of IBM ContextForge MCP Gateway through v1.0.4 can bypass the gateway's payload protection mechanisms because its recursive content inspection does not fully traverse deeply nested or embedded payload structures. Successful abuse yields limited but real integrity and confidentiality impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N) by allowing disallowed content or instructions to pass through the filter that is meant to stop them, undermining the gateway's role as a security boundary between MCP clients and downstream tool servers. There is no public exploit code or CISA KEV entry at time of analysis, and IBM has published a fix via its support portal, so exposure is limited to unpatched deployments reachable by an authenticated account.