CONTEXTFORGE MCP GATEWAY · CVE-2026-110189 · AI agents & MCP
FIX → 1.1.1 ✓ verified
IBM ContextForge MCP Gateway versions 1.0.8 through 1.0.11 and 1.1.0 have an incomplete denylist in their jq filter guard, so a crafted jsonpath_filter value containing halt, halt_error, or unbounded-loop built-ins gets past the check. An attacker with valid credentials can use this to kill gateway worker processes or exhaust resources.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams self-hosting IBM ContextForge MCP Gateway v1.0.8 to v1.0.11 or v1.1.0 where authenticated users can supply a jsonpath_filter (jq filter) on tools. An authenticated user can crash gateway workers or exhaust resources. Anyone on v1.1.1 or later can skip it.
Not affected if auth-required, default-config
Who cares ibm-contextforge, mcp, self-hosted
v1.0.8 to v1.0.11 or v1.1.0 and authenticated users can set a tool jsonpath_filter. v1.0.7 and earlier are not listed in this bulletin (they have a separate jq issue, CVE-2026-18486)IBM ContextForge MCP Gateway 1.0.8 through 1.0.11, and v1.1.0 is vulnerable to denial of service due to an incomplete denylist in the jq filter guard module (CWE-184). An authenticated remote attacker can supply a crafted jsonpath_filter value containing halt, halt_error, or unbounded-loop built-ins that bypass the safety check, causing gateway worker process termination or sustained resource exhaustion.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 1.1.1
v1.1.1