{"id":"CVE-2026-110195","kind":"vulnerability","aliases":["CVE-2026-110195"],"related":[],"title":"IBM ContextForge MCP Gateway: token cache lets users bypass upstream credential policies","description":"IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow an authenticated caller to bypass upstream credential-level authorization policies due to an insufficiently specific cache key in the RFC 8693 token exchange cache, enabling reuse of cached upstream bearer tokens across different credentials belonging to the same user.","summary":"IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 cache upstream bearer tokens from RFC 8693 token exchange under a key that is not specific enough. An authenticated user can reuse a cached token across different credentials they hold, bypassing upstream credential-level authorization policies.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM ContextForge MCP Gateway","fixed":["1.1.0"],"affected":">= 1.0.0, <= 1.0.11","ecosystem":"vendor"}],"ecosystems":[],"tags":["ai-tooling","ibm-contextforge","mcp","self-hosted","token-exchange"],"not_affected_if":["identical-credential-permissions","no-token-exchange","version-outside-range"],"how_to_check":"- Check the installed ContextForge version: affected is v1.0.0 through v1.0.11, fixed in v1.1.0.\n- Look at gateway OAuth config for token exchange (RFC 8693) with subject_token_source=inbound_user_jwt, where one account holds credential types with different upstream permissions (session JWT and API token). Without that setup you are not exposed.","fix":"Upgrade IBM ContextForge MCP Gateway to v1.1.0 or later. If you cannot, IBM's workaround: give all credential types (session JWTs, API tokens) of an account identical scopes in upstream MCP authorization policies, or avoid OAuth token exchange with subject_token_source=inbound_user_jwt across mixed credential types.","status":"open","published_at":"2026-11-13T22:17:20+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","triaged_at":"2026-11-13T22:34:40+00:00","updated_at":"2026-11-13T22:36:31+00:00","category":"ai-tooling","confidence":0.9,"triage":{"at":"2026-11-13T22:34:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM ContextForge MCP Gateway: token cache lets users bypass upstream credential policies","impact":"medium","summary":"IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 cache upstream bearer tokens from RFC 8693 token exchange under a key that is not specific enough. An authenticated user can reuse a cached token across different credentials they hold, bypassing upstream credential-level authorization policies.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["mcp","ibm-contextforge","token-exchange"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user bypasses upstream credential authorization policies","analyst_note":"Find the IBM advisory or NVD entry for the fixed version and the RFC 8693 cache configuration; the sources give no fix or setting.","how_to_check":"- Check the installed ContextForge version against the affected range `1.0.0` through `1.0.11`.\n- Look for RFC 8693 token exchange configuration in the gateway settings; the sources do not name a specific setting.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range","no-token-exchange"],"who_is_affected":"Teams running IBM ContextForge MCP Gateway in the affected range that use RFC 8693 token exchange to reach upstream services with per-credential authorization policies. Deployments that do not use token exchange, or that run a version outside the range, are not described as affected. The sources do not say which configurations are most exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00076,"input_tokens":4580,"output_tokens":604,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Find the IBM advisory or NVD entry for the fixed version and the RFC 8693 cache configuration; the sources give no fix or setting.","search":"'-110195':15A,18A '-2026':14A,17A '1.0.0':41B,85C '1.0.11':43B,87C '8693':50B,111C 'across':69B,122C 'ai':24B 'ai-tool':23B 'allow':89C 'authent':62B,91C 'author':79B,99C 'bearer':46B,120C 'belong':125C 'bypass':9A,74B,94C 'cach':6A,44B,67B,106C,114C,118C 'caller':92C 'contextforg':2A,28B,37B,82C 'contextforge':20A 'could':88C 'credenti':11A,71B,77B,97C,124C 'credential-level':76B,96C 'cve':13A,16A 'differ':70B,123C 'due':101C 'enabl':115C 'enough':60B 'exchang':35B,52B,113C 'gateway':4A,22A,39B,84C 'hold':73B 'host':32B 'ibm':1A,19A,27B,36B,81C 'ibm-contextforg':26B 'insuffici':104C 'key':55B,107C 'let':7A 'level':78B,98C 'mcp':3A,21A,29B,38B,83C 'polici':12A,80B,100C 'reus':65B,116C 'rfc':49B,110C 'self':31B 'self-host':30B 'specif':59B,105C 'token':5A,34B,47B,51B,68B,112C,121C 'token-exchang':33B 'tool':25B 'upstream':10A,45B,75B,95C,119C 'user':8A,63B,129C 'version':40B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM ContextForge MCP Gateway v1.0.0 to v1.0.11 with OAuth token exchange that uses the caller's inbound JWT. The token cache is keyed by gateway, user account and audience, not the specific JWT, so a restricted credential (such as an API token) can reuse an upstream bearer token cached by a higher-privileged credential (such as a session token) of the same account. Teams not using token exchange, or with identical upstream permissions for all credential types, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T22:36:31Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-authorization-bypass-vulnerability","run_id":3941},"products":{"at":"2026-11-13T22:36:31Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-authorization-bypass-vulnerability","run_id":3941},"how_to_check":{"at":"2026-11-13T22:36:31Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-authorization-bypass-vulnerability","run_id":3941},"who_affected":{"at":"2026-11-13T22:36:31Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-authorization-bypass-vulnerability","run_id":3941}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["contextforgemcpgateway","ibmcontextforgemcpgateway"],"ptokens":["contextforge","gateway","ibm","mcp"],"labels":["aitooling","ibmcontextforge","mcp","medium","selfhosted","tokenexchange"],"campaign_type":null,"search_a":"'-110195':15A,18A '-2026':14A,17A 'bypass':9A 'cach':6A 'contextforg':2A 'contextforge':20A 'credenti':11A 'cve':13A,16A 'gateway':4A,22A 'ibm':1A,19A 'let':7A 'mcp':3A,21A 'polici':12A 'token':5A 'upstream':10A 'user':8A","search_b":"'1.0.0':41B '1.0.11':43B '8693':50B 'across':69B 'ai':24B 'ai-tool':23B 'authent':62B 'author':79B 'bearer':46B 'bypass':74B 'cach':44B,67B 'contextforg':28B,37B 'credenti':71B,77B 'credential-level':76B 'differ':70B 'enough':60B 'exchang':35B,52B 'gateway':39B 'hold':73B 'host':32B 'ibm':27B,36B 'ibm-contextforg':26B 'key':55B 'level':78B 'mcp':29B,38B 'polici':80B 'reus':65B 'rfc':49B 'self':31B 'self-host':30B 'specif':59B 'token':34B,47B,51B,68B 'token-exchang':33B 'tool':25B 'upstream':45B,75B 'user':63B 'version':40B","search_c":"'1.0.0':85C '1.0.11':87C '8693':111C 'across':122C 'allow':89C 'authent':91C 'author':99C 'bearer':120C 'belong':125C 'bypass':94C 'cach':106C,114C,118C 'caller':92C 'contextforg':82C 'could':88C 'credenti':97C,124C 'credential-level':96C 'differ':123C 'due':101C 'enabl':115C 'exchang':113C 'gateway':84C 'ibm':81C 'insuffici':104C 'key':107C 'level':98C 'mcp':83C 'polici':100C 'reus':116C 'rfc':110C 'specif':105C 'token':112C,121C 'upstream':95C,119C 'user':129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110195","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110195","severity":null,"published_at":"2026-11-13T22:17:20+00:00","modified_at":"2026-11-13T22:17:20+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","fetched_at":"2026-11-13T22:33:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110195:3941","url":"https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-authorization-bypass-vulnerability","severity":null,"published_at":"2026-11-13T22:36:31+00:00","modified_at":"2026-11-13T22:36:31+00:00","first_seen_at":"2026-11-13T22:36:31+00:00","fetched_at":"2026-11-13T22:36:31+00:00","note":"IBM bulletin (primary) read: affected v1.0.0-v1.0.11, fixed v1.1.0; cache key not bound to inbound JWT, so an API token can reuse a bearer token cached by a session JWT of the same account. No exploitation or PoC found.","cites":["https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-authorization-bypass-vulnerability"]}],"documents":[{"id":150672,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-authorization-bypass-vulnerability","title":"IBM Security Bulletin: ContextForge MCP Gateway authorization bypass","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}