Description
MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output encoding before the MCP Admin UI renders it. An authenticated attacker can save markup containing script-capable event handlers, and the code executes when another user views the saved prompt. The stored cross-site scripting can alter the interface, present phishing content, observe keystrokes available to the page, and act with the viewer's browser session. This issue is fixed in version 0.3.1.
Published: 2026-10-13
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Stored Cross‑Site Scripting that can deface the interface, deliver phishing content, capture keystrokes, or execute actions with the viewer’s session
Action: Patch
AI Analysis

Impact

MCP Context Forge’s Global Prompts feature stored prompt templates without proper output encoding, allowing an authenticated attacker to inject markup that executes when other users view the prompt. The vulnerability can deface the admin UI, present phishing content, log keystrokes available to the page, and carry out actions using the viewer’s browser session.

Affected Systems

IBM MCP Context Forge versions from 0.2.0 up to, but not including, 0.3.1 are affected. The issue is resolved in version 0.3.1 and later.

Risk and Exploitability

The CVSS score of 5.1 denotes moderate risk. EPSS is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires authenticated access to the MCP Admin UI, which limits the attack surface to users with administrative privileges. An attacker could inject malicious markup that triggers when another privileged user views the prompt, leading to potential defacement, phishing, or session‑based attacks.

Generated by OpenCVE AI on October 13, 2026 at 17:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade IBM MCP Context Forge to version 0.3.1 or later, which includes the fix for the XSS issue.
  • Restrict access to the MCP Admin UI to trusted administrators and enforce least‑privilege principles.
  • Implement a Content Security Policy (CSP) that disallows inline scripts and restricts allowed sources of executable content to mitigate the impact of any remaining XSS vectors.

Generated by OpenCVE AI on October 13, 2026 at 17:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output encoding before the MCP Admin UI renders it. An authenticated attacker can save markup containing script-capable event handlers, and the code executes when another user views the saved prompt. The stored cross-site scripting can alter the interface, present phishing content, observe keystrokes available to the page, and act with the viewer's browser session. This issue is fixed in version 0.3.1.
Title MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-13T15:48:27.245Z

Reserved: 2026-06-10T16:43:31.241Z

Link: CVE-2026-53711

cve-icon Vulnrichment

Updated: 2026-10-13T15:47:52.618Z

cve-icon NVD

Status : Received

Published: 2026-10-13T15:17:45.030

Modified: 2026-10-13T16:17:21.167

Link: CVE-2026-53711

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T17:45:17Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')