Description
IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.
Published: 2026-09-04
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Information Disclosure via SSRF
Action: Upgrade Now
AI Analysis

Impact

The vulnerability in IBM ContextForge MCP Gateway allows a remotely authenticated attacker to trigger server‑side request forgery through DNS rebinding on the A2A agent invocation endpoint. By manipulating DNS resolution, the gateway can be coerced into making requests to internal or protected resources and thereby disclose sensitive information, illustrating a classic SSRF flaw (CWE‑918).

Affected Systems

Affected is IBM ContextForge MCP Gateway version 1.0.8 or earlier. IBM recommends upgrading to v1.0.9 to remove the flaw from all deployments that expose the A2A subsystem.

Risk and Exploitability

The CVSS score of 8.2 reflects high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation yet. Exploitation still requires remote authenticated access, so attackers with gateway credentials could abuse it by crafting DNS‑rebinding requests that resolve to internal targets. The risk is significant for environments exposing the A2A service without appropriate network controls.

Generated by OpenCVE AI on September 4, 2026 at 16:41 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM ContextForge MCP Gateway<= v1.0.8Upgrade to v1.0.9  https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9  Note: <Component A / B names> are bundled with <Product profile name> to provide <feature / function description>

Vendor Workaround

Operators who cannot immediately upgrade can reduce exposure by: 1. **Disable A2A** — set the environment variable `MCPGATEWAY_A2A_ENABLED=False` to disable the A2A subsystem entirely. This removes the vulnerable endpoint from the attack surface at the cost of A2A functionality. 2. **Restrict A2A create/invoke permissions** — revoke A2A creation and invocation rights from developer and team_admin roles in environments where A2A is not required. 3. **Network-level egress controls** — enforce outbound network policy at the host or cloud level to block the gateway process from reaching cloud metadata endpoints and private RFC 1918 address ranges, preventing exploitation of the DNS-rebinding window even if a rebind attempt succeeds. None of these mitigations eliminate the underlying vulnerability; IBM strongly recommends upgrading to the fixed version.

OpenCVE Recommended Actions

  • Upgrade IBM ContextForge MCP Gateway to v1.0.9 to eliminate the SSRF flaw.
  • Implement outbound network policies to block the gateway process from accessing cloud metadata endpoints and private RFC 1918 address ranges, preventing exploitation of the DNS‑rebinding window.
  • Revoke A2A creation and invocation rights from developer and team_admin roles in environments where A2A functionality is not required.
  • Disable the A2A subsystem by setting MCPGATEWAY_A2A_ENABLED=False to remove the vulnerable endpoint from the attack surface.

Generated by OpenCVE AI on September 4, 2026 at 16:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Ibm contextforge
CPEs cpe:2.3:a:ibm:contextforge:*:*:*:*:*:python:*:*
Vendors & Products Ibm contextforge

Mon, 07 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Ibm contextforge Mcp Gateway
Vendors & Products Ibm contextforge Mcp Gateway

Fri, 04 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 04 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.
Title IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint
First Time appeared Ibm
Ibm contextforge-mcp-gateway
Weaknesses CWE-918
CPEs cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm contextforge-mcp-gateway
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Ibm Contextforge Contextforge-mcp-gateway Contextforge Mcp Gateway
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-04T18:24:58.315Z

Reserved: 2026-08-21T14:36:12.469Z

Link: CVE-2026-77822

cve-icon Vulnrichment

Updated: 2026-09-04T17:09:16.341Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-04T16:17:59.550

Modified: 2026-09-15T15:16:27.183

Link: CVE-2026-77822

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T08:26:10Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)