IBM disclosed a server-side request forgery (SSRF) vulnerability in its ContextForge MCP Gateway product on November 13, 2026. The flaw, tracked as CVE-2026-110194, affects versions 1.0.0 through 1.0.11 and allows authenticated attackers to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
Quick Take
- What: Server-side request forgery vulnerability in IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11
- CVSS score: 5.4 (Medium severity)
- Who is affected: Organizations running IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11
- Fixed version: Version 1.1.0
- What to do: Upgrade to version 1.1.0 or apply workarounds if immediate upgrade is not possible
In plain English
IBM ContextForge MCP Gateway is a developer tool that helps manage connections between systems. A security flaw was found that lets someone who has logged in trick the gateway into sending requests to internal network addresses it should not access. This could help an attacker map out the internal network or launch further attacks. IBM fixed the problem in version 1.1.0.
What you should do: If you use this tool, you should upgrade. If you do not use IBM ContextForge MCP Gateway, you can ignore this issue.
What happened
IBM ContextForge MCP Gateway supports OAuth Dynamic Client Registration (RFC 7591), a standard that allows the gateway to read registration endpoints from an authorization server’s metadata document and send client registration, update, and delete requests to those endpoints.
The vulnerability exists because the gateway does not validate the endpoints taken from the authorization server metadata before sending requests to them. According to IBM’s security bulletin, this could allow an authenticated user to cause the gateway to send requests to internal hosts.
The flaw is classified under CWE-918 (Server-Side Request Forgery) and received a CVSS v3.1 base score of 5.4 with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. This indicates the vulnerability is exploitable over the network with low attack complexity, requires low privileges, needs no user interaction, and can result in low confidentiality and integrity impact with no availability impact.
IBM published the security bulletin on November 13, 2026, and the vulnerability details were also listed in the National Vulnerability Database.
What you should do
IBM strongly recommends upgrading to version 1.1.0, which addresses the vulnerability. The release notes for version 1.1.0 are available through IBM’s support portal.
If immediate upgrade is not possible, IBM provides several workarounds:
- Restrict the accepted authorization server issuers by setting
DCR_ALLOWED_ISSUERSto a list of trusted issuers - Disable Dynamic Client Registration by setting
DCR_ENABLED=false - Restrict gateway creation permissions to trusted users only
Organizations using IBM ContextForge MCP Gateway should assess their exposure and prioritize patching based on their specific environment and risk tolerance.
What it means
Server-side request forgery vulnerabilities allow attackers to abuse server functionality to access or modify resources that should be protected. In this case, an authenticated attacker could potentially use the IBM ContextForge MCP Gateway to probe internal network resources, enumerate services, or facilitate more sophisticated attacks against internal systems.
The medium severity rating reflects that exploitation requires authentication, limiting the pool of potential attackers to those who already have some level of access to the system. However, the vulnerability could still be leveraged as part of a broader attack chain to escalate privileges or move laterally within a network.
The fact that IBM provides multiple workaround options suggests the company recognizes that some organizations may need time to plan and execute upgrades in production environments.
