{"id":8883,"date":"2026-11-13T15:22:16","date_gmt":"2026-11-13T15:22:16","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service"},"modified":"2026-11-13T15:22:16","modified_gmt":"2026-11-13T15:22:16","slug":"cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service","title":{"rendered":"CVE-2026-18484: IBM ContextForge MCP Gateway denial of service via tool name collision"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>What:<\/strong> IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain a denial-of-service vulnerability (CVE-2026-18484) caused by improper slug normalization that allows tool name collisions.<\/li><li><strong>Who is affected:<\/strong> Teams using IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 where authenticated users have gateway-create permissions.<\/li><li><strong>What to do:<\/strong> Upgrade to version 1.1.0 immediately. If immediate upgrade is not possible, administrators can mitigate active collisions by renaming or removing conflicting gateway registrations.<\/li><li><strong>Severity:<\/strong> CVSS 6.5 (Medium), rated by IBM as High availability impact with network attack vector requiring low privileges and no user interaction.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">In plain English<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">IBM ContextForge MCP Gateway is a tool that helps teams manage and route requests to different AI tools. A flaw in how it handles tool names means that an authenticated user with permission to create gateways can register a gateway whose name collides with an existing tool. When this happens, the affected tool stops working for everyone on the team, and requests to use it fail with an error message. An administrator must manually fix the problem by renaming or removing one of the conflicting registrations. If you use this software, you should upgrade to version 1.1.0. If you do not use IBM ContextForge MCP Gateway, you can ignore this issue.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">IBM disclosed CVE-2026-18484 on October 27, 2026, affecting IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11. The vulnerability exists in the federated gateway tool-name normalization logic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An authenticated user with gateway-create permission can register a gateway whose computed tool slug collides with an existing public tool name in the same team. When this collision occurs, standard MCP <code>tools\/call<\/code> requests for the affected tool fail with an ambiguity error, rendering that tool unavailable to all team members until an administrator intervenes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">IBM assigned the vulnerability a CVSS v3.1 base score of 6.5 with the vector (CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:N\/A:H). The vulnerability is classified under CWE-706: Use of Incorrectly-Resolved Name or Reference.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What you should do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">IBM strongly recommends upgrading to version 1.1.0, which fixes the vulnerability. The v1.1.0 release notes are available from IBM.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If an immediate upgrade is not possible, administrators can mitigate an active collision by renaming or removing one of the two conflicting gateway registrations, which restores invocability of the affected tool. However, there is no configuration setting that prevents the collision from being created prior to the v1.1.0 fix, so upgrading remains the recommended solution.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What it means<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This vulnerability demonstrates a risk in federated gateway architectures where name normalization can create unintended collisions. While the vulnerability requires authenticated access and gateway-create permissions, it can disrupt service availability for entire teams by making specific tools inaccessible.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Medium severity rating reflects that the attack requires low privileges and can cause high availability impact, but does not affect confidentiality or integrity. Organizations using IBM ContextForge MCP Gateway should prioritize the upgrade to prevent potential service disruptions.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-18484\" target=\"_blank\" rel=\"noreferrer noopener\">NVD: CVE-2026-18484<\/a><\/li><li><a href=\"https:\/\/www.ibm.com\/support\/pages\/node\/7294233\" target=\"_blank\" rel=\"noreferrer noopener\">IBM Security Bulletin: IBM ContextForge MCP Gateway denial-of-service via tool name collision<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain a vulnerability that allows authenticated users to cause a denial of service by creating tool name collisions through improper slug normalization.<\/p>\n","protected":false},"author":2,"featured_media":8882,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"medium","_nx_sec_affected":"IBM ContextForge MCP Gateway 1.0.0\u20131.0.11","_nx_sec_status":"patch-available","_nx_sec_kicker":"ALERT: IBM MCP Gateway flaw lets authenticated users crash team tools","_nx_sec_type":"mcp","_nx_sec_vendor":"IBM","_nx_sec_fixed":"1.1.0","_nx_sec_action":""},"categories":[14,65,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-8883","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-agents","category-ai-security","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-18484: IBM ContextForge MCP Gateway DoS flaw<\/title>\n<meta name=\"description\" content=\"CVE-2026-18484 in IBM ContextForge MCP Gateway 1.0.0\u20131.0.11 lets authenticated users cause denial of service via tool name collisions. Patch available.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-18484: IBM ContextForge MCP Gateway DoS flaw\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-18484 in IBM ContextForge MCP Gateway 1.0.0\u20131.0.11 lets authenticated users cause denial of service via tool name collisions. Patch available.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-13T15:22:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"CVE-2026-18484: IBM ContextForge MCP Gateway denial of service via tool name collision\",\"datePublished\":\"2026-11-13T15:22:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service\"},\"wordCount\":507,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service-title.webp\",\"articleSection\":[\"Agents\",\"AI Security\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-13T15:22:16+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service\",\"name\":\"CVE-2026-18484: IBM ContextForge MCP Gateway DoS flaw\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service-title.webp\",\"datePublished\":\"2026-11-13T15:22:16+00:00\",\"description\":\"CVE-2026-18484 in IBM ContextForge MCP Gateway 1.0.0\u20131.0.11 lets authenticated users cause denial of service via tool name collisions. Patch available.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Image: AI-generated, i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2026-18484: IBM ContextForge MCP Gateway denial of service via tool name collision\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"},\"subjectOf\":[{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/papers.ssrn.com\\\/abstract=7426699\",\"name\":\"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/www.heise.de\\\/news\\\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html\",\"name\":\"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/t3n.de\\\/news\\\/bewerbung-schreiben-ki-5-fehler-1747190\\\/\",\"name\":\"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden\"}]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-18484: IBM ContextForge MCP Gateway DoS flaw","description":"CVE-2026-18484 in IBM ContextForge MCP Gateway 1.0.0\u20131.0.11 lets authenticated users cause denial of service via tool name collisions. Patch available.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service","og_locale":"en_US","og_type":"article","og_title":"CVE-2026-18484: IBM ContextForge MCP Gateway DoS flaw","og_description":"CVE-2026-18484 in IBM ContextForge MCP Gateway 1.0.0\u20131.0.11 lets authenticated users cause denial of service via tool name collisions. Patch available.","og_url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service","og_site_name":"i10X News","article_published_time":"2026-11-13T15:22:16+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_image":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"CVE-2026-18484: IBM ContextForge MCP Gateway denial of service via tool name collision","datePublished":"2026-11-13T15:22:16+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service"},"wordCount":507,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service-title.webp","articleSection":["Agents","AI Security","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-13T15:22:16+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service","url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service","name":"CVE-2026-18484: IBM ContextForge MCP Gateway DoS flaw","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service-title.webp","datePublished":"2026-11-13T15:22:16+00:00","description":"CVE-2026-18484 in IBM ContextForge MCP Gateway 1.0.0\u20131.0.11 lets authenticated users cause denial of service via tool name collisions. Patch available.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service-title.webp","width":1344,"height":768,"caption":"Image: AI-generated, i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-18484-ibm-contextforge-mcp-gateway-denial-of-service#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"CVE-2026-18484: IBM ContextForge MCP Gateway denial of service via tool name collision"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"},"subjectOf":[{"@type":"CreativeWork","url":"https:\/\/papers.ssrn.com\/abstract=7426699","name":"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens"},{"@type":"CreativeWork","url":"https:\/\/www.heise.de\/news\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html","name":"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT"},{"@type":"CreativeWork","url":"https:\/\/t3n.de\/news\/bewerbung-schreiben-ki-5-fehler-1747190\/","name":"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden"}]}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8883","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=8883"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8883\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/8882"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=8883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=8883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=8883"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=8883"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=8883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}