The vulnerability in IBM ContextForge MCP Gateway is triggered when an authenticated user with gateway‑creation privilege registers a gateway using OAuth client‑credentials authentication. The system fails to validate the oauth_config.token_url parameter and immediately issues an HTTP POST to that URL, forwarding credentials in the request body. An attacker can supply a malicious address pointing to internal services or cloud‑metadata endpoints, causing the gateway to send requests with privileged credentials. A 502 error then reflects up to 256 characters of the response, potentially exposing internal data. This flaw bypasses other SSRF mitigations that target only the gateway URL field.

IBM ContextForge MCP Gateway versions 0.1.0 through 1.0.5 are impacted. The vulnerability is fixed in v1.0.6 and later, which correctly validates the OAuth token_url parameter before making outbound calls.

The flaw requires an authenticated user who can create gateways, so the risk is confined to accounts with that privilege. The EPSS score is below 1% and the CVSS score of 5.4 indicate that the vulnerability is unlikely to be widely exploited but still poses a moderate risk by allowing arbitrary internal requests and leaking data. The attack vector is over the gateway registration API, making it an exploitable SSRF that could be leveraged to harvest credentials or access cloud metadata services. Because the flaw bypasses other controls, it remains a significant threat to affected installations.