Quick Take
- What: IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain a denial-of-service vulnerability (CVE-2026-18484) caused by improper slug normalization that allows tool name collisions.
- Who is affected: Teams using IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 where authenticated users have gateway-create permissions.
- What to do: Upgrade to version 1.1.0 immediately. If immediate upgrade is not possible, administrators can mitigate active collisions by renaming or removing conflicting gateway registrations.
- Severity: CVSS 6.5 (Medium), rated by IBM as High availability impact with network attack vector requiring low privileges and no user interaction.
In plain English
IBM ContextForge MCP Gateway is a tool that helps teams manage and route requests to different AI tools. A flaw in how it handles tool names means that an authenticated user with permission to create gateways can register a gateway whose name collides with an existing tool. When this happens, the affected tool stops working for everyone on the team, and requests to use it fail with an error message. An administrator must manually fix the problem by renaming or removing one of the conflicting registrations.
What you should do: If you use this software, you should upgrade to version 1.1.0. If you do not use IBM ContextForge MCP Gateway, you can ignore this issue.
What happened
IBM disclosed CVE-2026-18484 on October 27, 2026, affecting IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11. The vulnerability exists in the federated gateway tool-name normalization logic.
An authenticated user with gateway-create permission can register a gateway whose computed tool slug collides with an existing public tool name in the same team. When this collision occurs, standard MCP tools/call requests for the affected tool fail with an ambiguity error, rendering that tool unavailable to all team members until an administrator intervenes.
IBM assigned the vulnerability a CVSS v3.1 base score of 6.5 with the vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The vulnerability is classified under CWE-706: Use of Incorrectly-Resolved Name or Reference.
What you should do
IBM strongly recommends upgrading to version 1.1.0, which fixes the vulnerability. The v1.1.0 release notes are available from IBM.
If an immediate upgrade is not possible, administrators can mitigate an active collision by renaming or removing one of the two conflicting gateway registrations, which restores invocability of the affected tool. However, there is no configuration setting that prevents the collision from being created prior to the v1.1.0 fix, so upgrading remains the recommended solution.
What it means
This vulnerability demonstrates a risk in federated gateway architectures where name normalization can create unintended collisions. While the vulnerability requires authenticated access and gateway-create permissions, it can disrupt service availability for entire teams by making specific tools inaccessible.
The Medium severity rating reflects that the attack requires low privileges and can cause high availability impact, but does not affect confidentiality or integrity. Organizations using IBM ContextForge MCP Gateway should prioritize the upgrade to prevent potential service disruptions.
