{"id":"CVE-2026-110194","kind":"vulnerability","aliases":["CVE-2026-110194"],"related":[],"title":"IBM ContextForge MCP Gateway: authenticated users can make server-side requests","description":"IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.","summary":"IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain a server-side request forgery flaw. An logged-in attacker can make the gateway send requests to hosts they choose, which can enable internal network enumeration.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","ibm-contextforge","mcp","self-hosted"],"not_affected_if":["unauthenticated-access-blocked","version-above-1.0.11"],"how_to_check":"- Check the installed ContextForge MCP Gateway version against the affected range 1.0.0 through 1.0.11 (version source: unknown, check your deployment's package or image tag)\n- Confirm whether the gateway is reachable from untrusted networks, since the sources say authentication is required","fix":"- Upgrade to a version above `1.0.11`; the exact fixed version is unknown from the sources","status":"open","published_at":"2026-11-13T22:17:20+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","triaged_at":"2026-11-13T22:34:41+00:00","updated_at":"2026-11-13T22:34:41+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-13T22:34:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to a version above `1.0.11`; the exact fixed version is unknown from the sources","reach":"network","title":"IBM ContextForge MCP Gateway: authenticated users can make server-side requests","impact":"medium","summary":"IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain a server-side request forgery flaw. An logged-in attacker can make the gateway send requests to hosts they choose, which can enable internal network enumeration.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["ibm-contextforge","mcp","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reaches internal hosts via gateway, enabling network enumeration","analyst_note":"Confirm the fixed version and any configuration preconditions from the IBM security bulletin for CVE-2026-110194.","how_to_check":"- Check the installed ContextForge MCP Gateway version against the affected range 1.0.0 through 1.0.11 (version source: unknown, check your deployment's package or image tag)\n- Confirm whether the gateway is reachable from untrusted networks, since the sources say authentication is required","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unauthenticated-access-blocked","version-above-1.0.11"],"who_is_affected":"Teams running IBM ContextForge MCP Gateway in the 1.0.0 to 1.0.11 range are exposed. The sources say an authenticated attacker is required, so deployments where only trusted users hold accounts carry less risk. unknown whether default configurations change exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000776,"input_tokens":4562,"output_tokens":640,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110194':15A,18A '-2026':14A,17A '1.0.0':34B,70C '1.0.11':36B,72C 'ai':20B 'ai-tool':19B 'allow':84C 'attack':49B,87C,103C 'authent':5A,86C 'choos':59B 'contain':37B 'contextforg':2A,24B,30B,67C 'cve':13A,16A 'enabl':62B 'enumer':65B,99C 'facilit':101C 'flaw':44B 'forgeri':43B,80C 'gateway':4A,32B,53B,69C 'host':28B,57B 'ibm':1A,23B,29B,66C 'ibm-contextforg':22B 'intern':63B 'lead':96C 'log':47B 'logged-in':46B 'make':8A,51B 'may':83C 'mcp':3A,25B,31B,68C 'network':64B,98C 'potenti':95C 'request':12A,42B,55B,79C,91C 'self':27B 'self-host':26B 'send':54B,89C 'server':10A,40B,77C 'server-sid':9A,39B,76C 'side':11A,41B,78C 'ssrf':81C 'system':94C 'tool':21B 'unauthor':90C 'user':6A 'version':33B 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM ContextForge MCP Gateway in the 1.0.0 to 1.0.11 range are exposed. The sources say an authenticated attacker is required, so deployments where only trusted users hold accounts carry less risk. unknown whether default configurations change exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","ibmcontextforge","mcp","medium","selfhosted"],"campaign_type":null,"search_a":"'-110194':15A,18A '-2026':14A,17A 'authent':5A 'contextforg':2A 'cve':13A,16A 'gateway':4A 'ibm':1A 'make':8A 'mcp':3A 'request':12A 'server':10A 'server-sid':9A 'side':11A 'user':6A","search_b":"'1.0.0':34B '1.0.11':36B 'ai':20B 'ai-tool':19B 'attack':49B 'choos':59B 'contain':37B 'contextforg':24B,30B 'enabl':62B 'enumer':65B 'flaw':44B 'forgeri':43B 'gateway':32B,53B 'host':28B,57B 'ibm':23B,29B 'ibm-contextforg':22B 'intern':63B 'log':47B 'logged-in':46B 'make':51B 'mcp':25B,31B 'network':64B 'request':42B,55B 'self':27B 'self-host':26B 'send':54B 'server':40B 'server-sid':39B 'side':41B 'tool':21B 'version':33B","search_c":"'1.0.0':70C '1.0.11':72C 'allow':84C 'attack':87C,103C 'authent':86C 'contextforg':67C 'enumer':99C 'facilit':101C 'forgeri':80C 'gateway':69C 'ibm':66C 'lead':96C 'may':83C 'mcp':68C 'network':98C 'potenti':95C 'request':79C,91C 'send':89C 'server':77C 'server-sid':76C 'side':78C 'ssrf':81C 'system':94C 'unauthor':90C 'vulner':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110194","severity":null,"published_at":"2026-11-13T22:17:20+00:00","modified_at":"2026-11-13T22:17:20+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","fetched_at":"2026-11-13T22:33:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}