IBM has disclosed a DOM-based cross-site scripting vulnerability in its ContextForge MCP Gateway product that affects versions 1.0.0 through 1.0.11. The flaw, tracked as CVE-2026-110199, carries a CVSS score of 4.8 and has been fixed in version 1.1.0.
Quick Take
- What: DOM-based cross-site scripting (XSS) vulnerability in IBM ContextForge MCP Gateway admin dashboard
- Who is affected: Administrators using ContextForge MCP Gateway versions 1.0.0 through 1.0.11
- Attack vector: Privileged attacker persuades administrator to open a crafted link, enabling arbitrary JavaScript execution
- Fix: Upgrade to version 1.1.0
- Severity: Medium (CVSS 4.8)
In plain English
IBM ContextForge MCP Gateway is a tool for managing AI agent connections. A security flaw in its admin dashboard could let an attacker with some privileges trick an administrator into clicking a malicious link. If the administrator clicks the link while logged in, the attacker’s code could run in the admin’s browser and potentially steal login credentials. IBM has released version 1.1.0 that fixes this problem.
What you should do: If you use ContextForge MCP Gateway as an administrator, you should upgrade to the new version. If you don’t use this tool, you can ignore this issue.
What happened
The IBM ContextForge MCP Gateway admin dashboard displays status and error notifications to administrators using values supplied in the page URL. According to IBM’s security bulletin, the dashboard relies on a client-side HTML sanitizer before inserting those values into the page.
The vulnerability stems from a mutation XSS (mXSS) sanitizer bypass. An attacker can craft a URL that bypasses the sanitizer and embeds arbitrary JavaScript code in the Web UI. When an administrator opens the crafted link while authenticated, the malicious code executes in their browser session.
IBM categorizes this as CWE-79: Improper Neutralization of Input During Web Page Generation. The CVSS vector is (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), indicating the attack requires network access, high privileges, and user interaction, but has changed scope and could lead to low confidentiality and integrity impact.
The vulnerability affects IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 on Linux, Windows, and Mac OS platforms.
What you should do
IBM strongly recommends upgrading to version 1.1.0 immediately. The company states there are no workarounds or mitigations, and upgrading to the fixed version is the only remediation.
Administrators should install or upgrade to version 1.1.0 by following the instructions in the v1.1.0 Release Notes referenced in IBM’s security bulletin.
What it means
This vulnerability highlights the risks of DOM-based XSS attacks in administrative interfaces, particularly for AI infrastructure tools like MCP gateways that manage agent connections. While the attack requires high privileges and user interaction, successful exploitation could compromise administrator credentials and potentially grant attackers control over the MCP Gateway configuration.
The medium severity rating reflects the requirement for a privileged user to be tricked into clicking a malicious link. However, in environments where ContextForge MCP Gateway manages critical AI agent infrastructure, credential disclosure could have significant downstream impacts.
IBM disclosed the vulnerability on November 13, 2026, and released the patch simultaneously, following responsible disclosure practices.
