IBM discloses six medium-severity CVEs in ContextForge MCP Gateway

IBM disclosed six medium-severity vulnerabilities in its ContextForge MCP Gateway on November 13, 2026, according to the IBM ContextForge MCP Gateway security bulletin.

What changed

• IBM disclosed six CVEs on November 13, 2026: CVE-2026-110195, CVE-2026-110178, CVE-2026-110189, CVE-2026-110194, CVE-2026-110278 and CVE-2026-110279.
• CVE-2026-110195 (CVSS 5.4): an insufficiently specific cache key in the RFC 8693 token exchange cache lets an authenticated caller reuse another credential's cached upstream bearer token.
• CVE-2026-110178 (CVSS 4.1): improper access control in the bulk-import endpoint lets a team-scoped admin.import holder overwrite other tenants' tool and resource configurations, redirecting gateway calls to attacker-controlled hosts.
• CVE-2026-110189 (CVSS 6.5): an incomplete denylist in the jq filter guard lets an authenticated attacker crash or exhaust gateway worker processes using crafted jsonpath_filter values.
• CVE-2026-110194 (CVSS 5.4): an authenticated SSRF flaw via Dynamic Client Registration lets an attacker send unauthorized requests from the gateway; CVE-2026-110278 and CVE-2026-110279 round out the set, covering an authentication bypass and an information exposure issue.
• All six CVEs affect ContextForge MCP Gateway versions 1.0.0 through 1.0.11, with some extending to version 1.1.0, and IBM recommends upgrading to version 1.1.0 to fix them.

What it means for builders of AI agents

MCP gateways sit between AI agents and the tools and data they can reach, so access-control and SSRF flaws in a widely used gateway like IBM's directly expose organizations running agentic AI workflows to credential theft and cross-tenant data exposure.

Fix and context

IBM recommends upgrading to version 1.1.0 to address all six issues, with further detail available in the IBM/mcp-context-forge security advisories. The disclosure is separate from a November 11, 2026 SSRF fix in AWS's MCP Gateway Registry, an unrelated product from a different vendor.

Sources

• IBM ContextForge MCP Gateway security bulletin (IBM, November 13, 2026, official)
• IBM/mcp-context-forge security advisories (IBM (GitHub), November 13, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.