{"id":"CVE-2026-110178","kind":"vulnerability","aliases":["CVE-2026-110178"],"related":[],"title":"IBM ContextForge MCP Gateway: team admin can overwrite other tenants' public tools","description":"IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to improper access control in the bulk import path. A remote authenticated attacker holding a team-scoped `admin.import` permission can overwrite the endpoint URL, request headers, and authentication credentials of public tools, resources, and prompts owned by other tenants by sending a crafted POST request to `/v1/import` with `conflict_strategy=update`, redirecting subsequent AI gateway invocations to an attacker-controlled host.","summary":"A user with a team-scoped admin.import permission can use the bulk import endpoint to overwrite the URL, headers and credentials of public tools, resources and prompts owned by other tenants. Later gateway calls to those tools are then sent to an attacker-controlled host.","severity":"medium","cvss":4.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","ibm-contextforge","mcp","self-hosted"],"not_affected_if":["no-admin-import-users","single-tenant"],"how_to_check":"- Check the installed ContextForge MCP Gateway version; affected versions are `1.0.0` through `1.0.11`.\n- Review which accounts hold team-scoped `admin.import` permission.","fix":"- Move to a ContextForge MCP Gateway release later than `1.0.11` (the sources do not name the fixed version).","status":"open","published_at":"2026-11-13T22:17:20+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","triaged_at":"2026-11-13T22:34:45+00:00","updated_at":"2026-11-13T22:34:45+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-13T22:34:45Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a ContextForge MCP Gateway release later than `1.0.11` (the sources do not name the fixed version).","reach":"network","title":"IBM ContextForge MCP Gateway: team admin can overwrite other tenants' public tools","impact":"high","summary":"A user with a team-scoped admin.import permission can use the bulk import endpoint to overwrite the URL, headers and credentials of public tools, resources and prompts owned by other tenants. Later gateway calls to those tools are then sent to an attacker-controlled host.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["mcp","ibm-contextforge","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker redirects gateway tool calls to a host they control, capturing credentials","analyst_note":"Confirm the fixed ContextForge version and whether the vendor advisory names one; NVD text alone does not give it.","how_to_check":"- Check the installed ContextForge MCP Gateway version; affected versions are `1.0.0` through `1.0.11`.\n- Review which accounts hold team-scoped `admin.import` permission.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-tenant","no-admin-import-users"],"who_is_affected":"Teams running IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 in a multi-tenant setup, where some users hold team-scoped admin.import rights. Single-tenant deployments with no such users are less exposed. The sources do not describe default configuration.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000769,"input_tokens":4640,"output_tokens":610,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110178':15A,18A '-2026':14A,17A '/v1/import':132C '1.0.0':80C '1.0.11':82C 'access':87C 'admin':6A 'admin.import':36B,103C 'ai':20B,139C 'ai-tool':19B 'attack':73B,97C,145C 'attacker-control':72B,144C 'authent':96C,113C 'bulk':41B,91C 'call':63B 'conflict':134C 'contextforg':2A,24B,77C 'control':74B,88C,146C 'craft':128C 'credenti':50B,114C 'cve':13A,16A 'endpoint':43B,108C 'gateway':4A,62B,79C,140C 'header':48B,111C 'hold':98C 'host':28B,75B,147C 'ibm':1A,23B,76C 'ibm-contextforg':22B 'import':42B,92C 'improp':86C 'invoc':141C 'later':61B 'mcp':3A,25B,78C 'overwrit':8A,45B,106C 'own':57B,121C 'path':93C 'permiss':37B,104C 'post':129C 'prompt':56B,120C 'public':11A,52B,116C 'redirect':137C 'remot':95C 'request':110C,130C 'resourc':54B,118C 'scope':35B,102C 'self':27B 'self-host':26B 'send':126C 'sent':69B 'strategi':135C 'subsequ':138C 'team':5A,34B,101C 'team-scop':33B,100C 'tenant':10A,60B,124C 'tool':12A,21B,53B,66B,117C 'updat':136C 'url':47B,109C 'use':39B 'user':30B 'vulner':84C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 in a multi-tenant setup, where some users hold team-scoped admin.import rights. Single-tenant deployments with no such users are less exposed. The sources do not describe default configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","ibmcontextforge","mcp","medium","selfhosted"],"campaign_type":null,"search_a":"'-110178':15A,18A '-2026':14A,17A 'admin':6A 'contextforg':2A 'cve':13A,16A 'gateway':4A 'ibm':1A 'mcp':3A 'overwrit':8A 'public':11A 'team':5A 'tenant':10A 'tool':12A","search_b":"'admin.import':36B 'ai':20B 'ai-tool':19B 'attack':73B 'attacker-control':72B 'bulk':41B 'call':63B 'contextforg':24B 'control':74B 'credenti':50B 'endpoint':43B 'gateway':62B 'header':48B 'host':28B,75B 'ibm':23B 'ibm-contextforg':22B 'import':42B 'later':61B 'mcp':25B 'overwrit':45B 'own':57B 'permiss':37B 'prompt':56B 'public':52B 'resourc':54B 'scope':35B 'self':27B 'self-host':26B 'sent':69B 'team':34B 'team-scop':33B 'tenant':60B 'tool':21B,53B,66B 'url':47B 'use':39B 'user':30B","search_c":"'/v1/import':132C '1.0.0':80C '1.0.11':82C 'access':87C 'admin.import':103C 'ai':139C 'attack':97C,145C 'attacker-control':144C 'authent':96C,113C 'bulk':91C 'conflict':134C 'contextforg':77C 'control':88C,146C 'craft':128C 'credenti':114C 'endpoint':108C 'gateway':79C,140C 'header':111C 'hold':98C 'host':147C 'ibm':76C 'import':92C 'improp':86C 'invoc':141C 'mcp':78C 'overwrit':106C 'own':121C 'path':93C 'permiss':104C 'post':129C 'prompt':120C 'public':116C 'redirect':137C 'remot':95C 'request':110C,130C 'resourc':118C 'scope':102C 'send':126C 'strategi':135C 'subsequ':138C 'team':101C 'team-scop':100C 'tenant':124C 'tool':117C 'updat':136C 'url':109C 'vulner':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110178","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110178","severity":null,"published_at":"2026-11-13T22:17:20+00:00","modified_at":"2026-11-13T22:17:20+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","fetched_at":"2026-11-13T22:33:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}