Bypass Vulnerability in IBM ContextForge MCP Gateway Affects Security Measures
CVE-2026-11918

5.4MEDIUM

Key Information:

Vendor

IBM
Status
Contextforge Mcp Gateway
Vendor
CVE Published:
15 September 2026

What is CVE-2026-11918?

A security flaw in IBM ContextForge MCP Gateway versions up to 1.0.4 permits an authenticated user to circumvent security measures. This occurs due to an incomplete recursive inspection process of nested payload content, potentially exposing the system to unauthorized actions. Organizations utilizing this product should evaluate their security posture and apply necessary updates as outlined in the vendor advisory.

Affected Version(s)

ContextForge MCP Gateway <= v1.0.4

References

https://www.ibm.com/support/pages/node/7285720
vendor-advisorypatch

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.