IBM MCP Context Forge up to 1.0.1 python_sandbox_server server_fastmcp.py execute_code os command injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in IBM MCP Context Forge up to 1.0.1. The affected element is the function execute_code of the file mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py of the component python_sandbox_server. This manipulation causes os command injection. This vulnerability is tracked as CVE-2026-53710. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in IBM MCP Context Forge up to 1.0.1. It has been declared as critical. Affected by this vulnerability is the function execute_code of the file mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py of the component python_sandbox_server. The manipulation with an unknown input leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr through safe_builtins, omits a required _getattr_ guard, and relies on validate_code checks for literal dangerous dunder strings. An attacker can construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands with the server process privileges through the execute_code MCP tool. The HTTP/SSE transport can expose this tool without authentication, while stdio-only deployments have reduced network reachability. The issue affects the python_sandbox_server subproject and does not directly affect the core Context Forge gateway or proxy components. This issue is fixed in version 1.0.2.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-53710 since 06/10/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/15/2026). MITRE ATT&CK project uses the attack technique T1202 for this issue.

Upgrading to version 1.0.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-78933). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• IBM

Name

• MCP Context Forge

Version

• 1.0.0
• 1.0.1

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion