IBM MCP Context Forge up to 1.0.2 Gateway Validation mcpgateway/admin.py validate_gateway_test_url server-side request forgery

Summaryinfo

A vulnerability, which was classified as problematic, was found in IBM MCP Context Forge up to 1.0.2. This issue affects the function validate_gateway_test_url of the file mcpgateway/admin.py of the component Gateway Validation. Executing a manipulation can lead to server-side request forgery. The identification of this vulnerability is CVE-2026-53708. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in IBM MCP Context Forge up to 1.0.2. It has been declared as problematic. This vulnerability affects the function validate_gateway_test_url of the file mcpgateway/admin.py of the component Gateway Validation. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validate_gateway_test_url() in mcpgateway/common/validators.py to resolve and reject private, loopback, link-local, and cloud-metadata addresses, but ResilientHttpClient later resolves the original hostname again without binding the validated address. When MCPGATEWAY_ADMIN_API_ENABLED is enabled, an attacker with a database-backed role containing explicit gateways.read permission can use DNS rebinding to return a public address during validation and a private or metadata address during connection, bypassing ssrf_blocked_networks and ssrf_dns_fail_closed because those controls apply only to the validation-time result. The endpoint's allow_admin_bypass=False setting means a bootstrap-only virtual platform-admin identity without a database role is not sufficient. Successful exploitation can reach internal services and cloud metadata, expose cloud credentials, access internal APIs, or probe internal network ports. This issue is fixed in version 1.0.3.

The advisory is available at github.com. This vulnerability was named CVE-2026-53708 since 06/10/2026. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are needed for exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 09/14/2026).

Upgrading to version 1.0.3 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• IBM

Name

• MCP Context Forge

Version

• 1.0.0
• 1.0.1
• 1.0.2

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion