Advisories · Technology

IBM ContextForge MCP Gateway.

Every CVE that names IBM ContextForge MCP Gateway among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-8355 CVE record

CVSS 5.4 Medium

IBM ContextForge MCP Gateway is affected by server-side request forgery
- IBM ContextForge MCP Gateway
- Server-side request forgery (SSRF)
Not analysed yet 19 Oct 2026
CVE-2026-77825 CVE record

CVSS 4.9 Medium

IBM ContextForge MCP Gateway is affected by path traversal
- IBM ContextForge MCP Gateway
- Path traversal
Not analysed yet 24 Sept 2026
CVE-2026-11918 CVE record

CVSS 5.4 Medium

IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures
- IBM ContextForge MCP Gateway
- CWE-184
Not analysed yet 15 Sept 2026
CVE-2026-78573 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

IBM ContextForge MCP Gateway is affected by use of default credentials
- IBM ContextForge MCP Gateway
- CWE-1392
Not analysed yet 10 Sept 2026
CVE-2026-18486 CVE record

CVSS 8.8 High

IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter execution
- IBM ContextForge MCP Gateway
- Information disclosure
Not analysed yet 4 Sept 2026
CVE-2026-77822 CVE record

CVSS 8.2 High

IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint
- IBM ContextForge MCP Gateway
- Server-side request forgery (SSRF)
Not analysed yet 4 Sept 2026