PT-2026-92142 · Ibm · Mcp-Contextforge-Gateway
CVE-2026-11918
·
Published
2026-09-15
·
Updated
2026-09-20
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
IBM ContextForge MCP Gateway versions prior to 1.0.5
Description
An authenticated user can bypass protection mechanisms in the IBM mcp-context-forge component. This occurs because the system performs an incomplete recursive inspection of nested payload content, allowing potentially malicious data to evade security checks.
Recommendations
Update IBM ContextForge MCP Gateway to version 1.0.5 or later.
Fix
Incomplete List of Disallowed Inputs
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mcp-Contextforge-Gateway