IBM CONTEXTFORGE MCP GATEWAY · CVE-2026-110199 · AI agents & MCP
FIX → 1.1.0 ✓ verified
The ContextForge admin dashboard puts status and error notifications from URL values into the page after a client-side HTML sanitizer, which can be bypassed (mutation XSS). An attacker who gets an administrator to open a crafted link can run JavaScript in that admin's authenticated session, with possible credential disclosure. IBM rates it CVSS 4.8. Fixed in v1.1.0; IBM lists no workaround.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted IBM ContextForge MCP Gateway v1.0.0 through v1.0.11 with the admin dashboard in use. An attacker must persuade an administrator to open a crafted link, so exposure is mainly admin accounts. Teams on v1.1.0 or later can skip it.
Not affected if version-outside-range
Who cares ibm-contextforge, mcp, self-hosted
v1.0.0 through v1.0.11 are affected; v1.1.0 is fixedIBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 1.1.0
v1.1.0