CVE-2026-110278

Name of the Vulnerable Software and Affected Versions IBM ContextForge MCP Gateway versions 1.0.0 through 1.1.0

Description Static signature payloads and missing per-gateway configuration checks during tool invocation allow an attacker to replay identity propagation claims signatures. Additionally, the gateway ignores per-server identity settings, which can expose sensitive user identity information, such as user ID, email, and groups, to third-party MCP servers that are configured to receive no identity data.

Recommendations Upgrade to version 1.1.1. Switch identity propagation off.