---
id: "CVE-2026-110195"
page: "https://infrastack.ai/live/CVE-2026-110195"
kind: "vulnerability"
aliases: ["CVE-2026-110195"]
title: "IBM ContextForge MCP Gateway: token cache lets users bypass upstream credential policies"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "IBM ContextForge MCP Gateway", "fixed": ["1.1.0"], "affected": ">= 1.0.0, <= 1.0.11", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ai-tooling", "ibm-contextforge", "mcp", "self-hosted", "token-exchange"]
not_affected_if: ["identical-credential-permissions", "no-token-exchange", "version-outside-range"]
published_at: "2026-11-13T22:17:20+00:00"
first_seen_at: "2026-11-13T22:33:33+00:00"
updated_at: "2026-11-13T22:36:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110195", "first_seen_at": "2026-11-13T22:33:33+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-authorization-bypass-vulnerability", "first_seen_at": "2026-11-13T22:36:31+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-authorization-bypass-vulnerability"]}]
exploit_sources: []
---

# IBM ContextForge MCP Gateway: token cache lets users bypass upstream credential policies

Link for people: https://infrastack.ai/live/CVE-2026-110195 (this .md is for agents)

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 cache upstream bearer tokens from RFC 8693 token exchange under a key that is not specific enough. An authenticated user can reuse a cached token across different credentials they hold, bypassing upstream credential-level authorization policies.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM ContextForge MCP Gateway affected >= 1.0.0, <= 1.0.11 fixed 1.1.0

## How to check

- Check the installed ContextForge version: affected is v1.0.0 through v1.0.11, fixed in v1.1.0.
- Look at gateway OAuth config for token exchange (RFC 8693) with subject_token_source=inbound_user_jwt, where one account holds credential types with different upstream permissions (session JWT and API token). Without that setup you are not exposed.

## Fix

Upgrade IBM ContextForge MCP Gateway to v1.1.0 or later. If you cannot, IBM's workaround: give all credential types (session JWTs, API tokens) of an account identical scopes in upstream MCP authorization policies, or avoid OAuth token exchange with subject_token_source=inbound_user_jwt across mixed credential types.

## Timeline

- 2026-11-13T22:33:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110195
- 2026-11-13T22:36:31+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-authorization-bypass-vulnerability — IBM bulletin (primary) read: affected v1.0.0-v1.0.11, fixed v1.1.0; cache key not bound to inbound JWT, so an API token can reuse a bearer token cached by a session JWT of the same account. No exploitation or PoC found.

## Documents

- [advisory] IBM Security Bulletin: ContextForge MCP Gateway authorization bypass https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-authorization-bypass-vulnerability

## From the sources

IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow an authenticated caller to bypass upstream credential-level authorization policies due to an insufficiently specific cache key in the RFC 8693 token exchange cache, enabling reuse of cached upstream bearer tokens across different credentials belonging to the same user.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_