Denial of Service Vulnerability in IBM ContextForge MCP Gateway
CVE-2026-110189

6.5MEDIUM

Key Information:

Vendor

IBM
Status
Contextforge Mcp Gateway
Vendor
CVE Published:
13 November 2026

What is CVE-2026-110189?

IBM ContextForge MCP Gateway versions 1.0.8 through 1.1.0 are subject to a denial of service vulnerability stemming from an incomplete denylist within the jq filter guard module. This flaw allows authenticated remote attackers to supply a specially crafted jsonpath_filter value containing risky built-ins such as halt, halt_error, or unbounded loops, successfully bypassing the intended safety checks. The exploitation of this vulnerability can lead to the termination of the gateway worker process or prolonged resource exhaustion, affecting the availability of services.

Affected Version(s)

ContextForge MCP Gateway 1.0.8 <= 1.0.11

ContextForge MCP Gateway 1.1.0

References

https://www.ibm.com/support/pages/node/7296697
vendor-advisorypatch

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.