CVE-2026-77825

Name of the Vulnerable Software and Affected Versions IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.8

Description An authenticated administrator can perform path traversal via the Admin API log-download endpoint GET /v1/admin/logs/file. The issue occurs because the path confinement check utilizes str.startswith() instead of proper boundary validation. This allows the retrieval of .log, .jsonl, and .json files located outside the configured LOG FOLDER by providing a filename that resolves to a sibling directory sharing the same string prefix as the log directory.

Recommendations Update IBM ContextForge MCP Gateway to a version later than 1.0.8. Restrict access to the GET /v1/admin/logs/file endpoint to minimize the risk of unauthorized file access.