IBM Contextforge Mcp Gateway
6 CVEs affecting IBM Contextforge Mcp Gateway. Latest disclosed: 2026-10-20. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-78573 | Critical | 9.8 | 2026-09-10 | IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials. |
CVE-2026-18486 | High | 8.8 | 2026-09-04 | IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges du… |
CVE-2026-77822 | High | 8.2 | 2026-09-04 | IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding. |
CVE-2026-8355 | Medium | 5.4 | 2026-10-20 | IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation pr… |
CVE-2026-11918 | Medium | 5.4 | 2026-09-15 | IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive insp… |
CVE-2026-77825 | Medium | 4.9 | 2026-09-24 | IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint (`GET /v1/admin/logs/file`). The path… |