CVE-2026-18489

Summary

IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.

Affected Software

Weaknesses

• CWE-488: CWE-488 Exposure of Data Element to Wrong Session

Workarounds

Do not use the IBM ContextForge Translate service in any production or multi-client environment. The service is designed exclusively for local development scenarios where only a single client session is expected. This applies regardless of whether --enable-dynamic-env is active.

If the Translate service is currently running in a non-development environment:

1. Stop the Translate service and remove it from any production deployment immediately.

2. Rotate any credentials (API tokens, Authorization headers) that may have been mapped into the shared subprocess environment while multiple clients were connected.

3. Review audit logs for tool calls where the HTTP caller identity may not match the subprocess credential context.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://www.ibm.com/support/pages/node/7286056

• ←Previous
• Next→