---
id: "CVE-2026-110178"
page: "https://infrastack.ai/live/CVE-2026-110178"
kind: "vulnerability"
aliases: ["CVE-2026-110178"]
title: "IBM ContextForge MCP Gateway: team admin can overwrite other tenants' public tools"
severity: "medium"
cvss: 4.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "ibm-contextforge", "mcp", "self-hosted"]
not_affected_if: ["no-admin-import-users", "single-tenant"]
published_at: "2026-11-13T22:17:20+00:00"
first_seen_at: "2026-11-13T22:33:33+00:00"
updated_at: "2026-11-13T22:34:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110178", "first_seen_at": "2026-11-13T22:33:33+00:00"}]
exploit_sources: []
---

# IBM ContextForge MCP Gateway: team admin can overwrite other tenants' public tools

Link for people: https://infrastack.ai/live/CVE-2026-110178 (this .md is for agents)

A user with a team-scoped admin.import permission can use the bulk import endpoint to overwrite the URL, headers and credentials of public tools, resources and prompts owned by other tenants. Later gateway calls to those tools are then sent to an attacker-controlled host.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ContextForge MCP Gateway version; affected versions are `1.0.0` through `1.0.11`.
- Review which accounts hold team-scoped `admin.import` permission.

## Fix

- Move to a ContextForge MCP Gateway release later than `1.0.11` (the sources do not name the fixed version).

## Timeline

- 2026-11-13T22:33:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110178

## From the sources

IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to improper access control in the bulk import path. A remote authenticated attacker holding a team-scoped `admin.import` permission can overwrite the endpoint URL, request headers, and authentication credentials of public tools, resources, and prompts owned by other tenants by sending a crafted POST request to `/v1/import` with `conflict_strategy=update`, redirecting subsequent AI gateway invocations to an attacker-controlled host.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_