IBM disclosed CVE-2026-110195 on November 13, 2026, affecting IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11. The vulnerability stems from an insufficiently specific cache key in the gateway’s RFC 8693 token exchange implementation.
Quick Take
- What: CVE-2026-110195, an authorization bypass in IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 due to an insufficiently specific cache key in the RFC 8693 token exchange cache
- Impact: Authenticated users can reuse cached upstream bearer tokens obtained by higher-privileged credentials (such as interactive session tokens) when using lower-privileged credentials (such as API tokens)
- Who is affected: Organizations running IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 with OAuth token exchange configured using
subject_token_source=inbound_user_jwt - Fix: Upgrade to IBM ContextForge MCP Gateway v1.1.0
- Severity: Medium (CVSS 5.4)
In plain English
IBM ContextForge MCP Gateway is a tool that helps connect AI systems to data sources using the Model Context Protocol. A security flaw was found in how it handles authentication tokens. When the gateway exchanges tokens with upstream servers, it caches those tokens to improve performance, but the cache did not properly separate tokens for different types of credentials belonging to the same user account. This means someone logged in with a restricted API key could accidentally reuse a more powerful token that was cached from an earlier interactive login session.
What you should do: If you use this gateway software, you should upgrade to version 1.1.0, otherwise you can ignore this issue.
What happened
When configured to use a caller’s inbound JSON Web Token (JWT) to obtain an exchanged access token from an OAuth authorization server for an upstream Model Context Protocol (MCP) server, the gateway caches upstream tokens by gateway, user account, and target audience. However, the cache does not bind entries to the specific inbound JWT credential that obtained them.
This design flaw allows an authenticated user with a restricted credential (such as an API token with limited upstream permissions) to reuse an upstream bearer token that was previously obtained and cached by a higher-privileged credential belonging to the same user account (such as an interactive session token). The result is an authorization bypass that violates upstream credential-level authorization policies.
IBM assigned the vulnerability a CVSS v3.1 base score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), categorizing it as medium severity. The vulnerability is classified under CWE-287: Improper Authentication.
The issue was reported to IBM by Nick Simpson.
What you should do
IBM strongly recommends upgrading to IBM ContextForge MCP Gateway v1.1.0, which addresses the vulnerability. Release notes for v1.1.0 are available through IBM’s support portal.
If immediate upgrade is not possible, IBM advises ensuring that authorization policies for upstream MCP servers assign identical scopes and permissions to all credential types (interactive session JWTs and API tokens) for a given account. Alternatively, organizations should avoid configuring OAuth token exchange with subject_token_source=inbound_user_jwt across mixed credential types until the gateway is updated.
What it means
This vulnerability highlights the complexity of implementing secure token caching in multi-credential environments. While the CVSS score of 5.4 places it in the medium severity range, the practical impact depends heavily on how organizations have configured their upstream authorization policies and credential types.
The flaw requires an attacker to already be authenticated, which limits the attack surface. However, in environments where users have multiple credential types with different permission levels (a common security practice), the vulnerability could allow privilege escalation within the same user account.
The issue is specific to deployments using OAuth token exchange with inbound user JWTs and does not affect all ContextForge MCP Gateway configurations. Organizations not using this specific feature are not impacted.
