Vulnerability details

CVE-2026-77822

IBM ContextForge MCP Gateway

IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint

CVSS 3.1

8.2High

Official description

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.

CVSS scores

Score	Version	Source	Vector
8.2High	3.1	CVEProject cvelistV5 (CNA) (ibm)	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
IBM	ContextForge MCP Gateway	<= v1.0.8	CVEProject cvelistV5 (CNA)

References and advisories

https://www.ibm.com/support/pages/node/7286055 vendor-advisorypatch

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-04
Last updated: 2026-09-04
State: Published
Assigner (CNA): ibm

Exploit prediction (EPSS)

0.37%

Probability of exploitation in 30 days

31.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-918
Server-Side Request Forgery (SSRF)