CVE-2026-11918
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Summary
IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| IBM | ContextForge MCP Gateway | <= v1.0.4 | affected |
Weaknesses
- CWE-184: CWE-184 Incomplete List of Disallowed Inputs
Workarounds
There is no workaround that fully prevents the bypass while keeping the affected plugins active. Operators may disable regex_filter and deny_filter in plugins/config.yaml to prevent exploitation, at the cost of losing the filtering controls those plugins provide.
IBM strongly recommends upgrading to v1.0.5 or higher, which replaces the top-level-only scan loops with a recursive walker in both plugins.
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.