Server-Side Request Forgery Vulnerability in IBM ContextForge MCP Gateway

CVE-2026-8355

What is CVE-2026-8355?

The IBM ContextForge MCP Gateway, versions 0.1.0 through 1.0.5, is susceptible to a server-side request forgery (SSRF) flaw. This allows authenticated users with gateway creation privileges to initiate arbitrary HTTP POST requests to internal network resources and critical cloud metadata endpoints. The vulnerability arises during the OAuth-enabled gateway registration process due to inadequate validation of the oauth_config.token_url parameter. An attacker can exploit this during gateway registration by supplying a harmful token_url that points to internal services or sensitive cloud metadata endpoints (like AWS IMDSv1, GCP, Azure). Consequently, the application executes an unauthorized HTTP POST request to the specified attacker-controlled URL containing sensitive form-encoded credentials. If the server's response is not recognizable as a valid OAuth token response, portions of the response body, limited to 256 characters, may be inadvertently displayed in the HTTP 502 error message. This bypasses the SSRF protections currently implemented in the gateway.url configuration, emphasizing the need for enhanced security reviews and prompt application updates.

References