Ibm

Contextforge

6 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.9

CVE-2026-77825

  • EPSS 0.32%
  • Veröffentlicht 24.09.2026 14:21:18
  • Zuletzt bearbeitet 29.09.2026 13:26:00

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint (`GET /v1/admin/logs/file`). The path confinement check uses `str.startswith()` rather than proper boundary validation, allowing ...

9.8

CVE-2026-78573

  • EPSS 0.39%
  • Veröffentlicht 10.09.2026 21:42:36
  • Zuletzt bearbeitet 16.09.2026 00:50:11

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.

8.8

CVE-2026-18486

  • EPSS 0.32%
  • Veröffentlicht 04.09.2026 16:24:45
  • Zuletzt bearbeitet 15.09.2026 15:05:06

IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters.

7.4

CVE-2026-18489

  • EPSS 0.26%
  • Veröffentlicht 04.09.2026 16:23:08
  • Zuletzt bearbeitet 15.09.2026 15:04:09

IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.

7.7

CVE-2026-18905

  • EPSS 0.31%
  • Veröffentlicht 04.09.2026 15:56:28
  • Zuletzt bearbeitet 15.09.2026 15:21:14

IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation.

9.6

CVE-2026-77822

  • EPSS 0.21%
  • Veröffentlicht 04.09.2026 15:15:35
  • Zuletzt bearbeitet 15.09.2026 15:16:27

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.