Mcp Context Forge
Monthly
Improper authentication in IBM MCP Context Forge prior to 1.0.2 allows remote, unauthenticated attackers to forge HS256-signed JWTs using a JWT_SECRET_KEY shipped in mcpgateway/config.py and .env.example, gaining full platform-administrator access without a database account. The attack requires two conditions to hold simultaneously: the gateway must still use the known shipped signing key, and the platform-admin bootstrap must be active (REQUIRE_USER_IN_DB=false with the token subject set to PLATFORM_ADMIN_EMAIL); because the documented production default for REQUIRE_USER_IN_DB is true, strictly default production deployments are protected, as are operators who rotated the secret before upgrading. Where both conditions are met, forged administrator tokens survive password rotation, account deletion, and session revocation, enabling administrative disclosure, modification, and service disruption; no public exploit code has been identified at time of analysis and the issue is fixed in 1.0.2.
Sandbox escape in the python_sandbox_server subproject of IBM MCP Context Forge (versions up to and including 1.0.1) allows a remote, unauthenticated attacker to execute arbitrary OS commands with the privileges of the server process. The vulnerable execute_code MCP tool can be exposed over the HTTP/SSE transport without any authentication layer, so any client that can reach the endpoint can submit a payload via tools/call; publicly available exploit code exists (the vendor advisory includes a working local PoC with artifact hashes). Exploitation is conditional on the optional python_sandbox_server being deployed and network-reachable - the core Context Forge gateway and proxy components are not directly affected, and stdio-only deployments are not remotely exposed - but when reachable it is a critical-severity, unauthenticated code-execution path.
Stored cross-site scripting in IBM's MCP Context Forge (versions 0.2.0 up to but not including 0.3.1) lets an authenticated user who can create or save a Global Prompt store markup with script-capable event handlers, which then executes in the browser of any other user who views that saved prompt in the MCP Admin UI. Successful exploitation can rewrite the interface, display phishing content, capture keystrokes reachable by the page, and perform actions with the victim's browser session, but it requires a valid account, an enabled Admin UI, and a second user to open the prompt. There is no public exploit identified at time of analysis, no KEV listing, and the vendor-released patch in version 0.3.1 (commit acd1619, PR #337) also flips MCPGATEWAY_UI_ENABLED and MCPGATEWAY_ADMIN_API_ENABLED to false by default, removing the surface entirely for patched deployments.
Improper authentication in IBM MCP Context Forge prior to 1.0.2 allows remote, unauthenticated attackers to forge HS256-signed JWTs using a JWT_SECRET_KEY shipped in mcpgateway/config.py and .env.example, gaining full platform-administrator access without a database account. The attack requires two conditions to hold simultaneously: the gateway must still use the known shipped signing key, and the platform-admin bootstrap must be active (REQUIRE_USER_IN_DB=false with the token subject set to PLATFORM_ADMIN_EMAIL); because the documented production default for REQUIRE_USER_IN_DB is true, strictly default production deployments are protected, as are operators who rotated the secret before upgrading. Where both conditions are met, forged administrator tokens survive password rotation, account deletion, and session revocation, enabling administrative disclosure, modification, and service disruption; no public exploit code has been identified at time of analysis and the issue is fixed in 1.0.2.
Sandbox escape in the python_sandbox_server subproject of IBM MCP Context Forge (versions up to and including 1.0.1) allows a remote, unauthenticated attacker to execute arbitrary OS commands with the privileges of the server process. The vulnerable execute_code MCP tool can be exposed over the HTTP/SSE transport without any authentication layer, so any client that can reach the endpoint can submit a payload via tools/call; publicly available exploit code exists (the vendor advisory includes a working local PoC with artifact hashes). Exploitation is conditional on the optional python_sandbox_server being deployed and network-reachable - the core Context Forge gateway and proxy components are not directly affected, and stdio-only deployments are not remotely exposed - but when reachable it is a critical-severity, unauthenticated code-execution path.
Stored cross-site scripting in IBM's MCP Context Forge (versions 0.2.0 up to but not including 0.3.1) lets an authenticated user who can create or save a Global Prompt store markup with script-capable event handlers, which then executes in the browser of any other user who views that saved prompt in the MCP Admin UI. Successful exploitation can rewrite the interface, display phishing content, capture keystrokes reachable by the page, and perform actions with the victim's browser session, but it requires a valid account, an enabled Admin UI, and a second user to open the prompt. There is no public exploit identified at time of analysis, no KEV listing, and the vendor-released patch in version 0.3.1 (commit acd1619, PR #337) also flips MCPGATEWAY_UI_ENABLED and MCPGATEWAY_ADMIN_API_ENABLED to false by default, removing the surface entirely for patched deployments.