{"id":"CVE-2026-110199","kind":"vulnerability","aliases":["CVE-2026-110199"],"related":[],"title":"IBM ContextForge MCP Gateway: DOM-based XSS in admin dashboard via crafted link","description":"IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.","summary":"The ContextForge admin dashboard puts status and error notifications from URL values into the page after a client-side HTML sanitizer, which can be bypassed (mutation XSS). An attacker who gets an administrator to open a crafted link can run JavaScript in that admin's authenticated session, with possible credential disclosure. IBM rates it CVSS 4.8. Fixed in v1.1.0; IBM lists no workaround.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM ContextForge MCP Gateway","fixed":["1.1.0"],"affected":">= 1.0.0, <= 1.0.11","ecosystem":"vendor"}],"ecosystems":[],"tags":["ai-tooling","ibm-contextforge","mcp","self-hosted"],"not_affected_if":["version-outside-range"],"how_to_check":"Check the installed ContextForge MCP Gateway version. Versions v1.0.0 through v1.0.11 are affected; v1.1.0 is fixed. Only deployments with the admin dashboard reachable by administrators matter.","fix":"Upgrade IBM ContextForge MCP Gateway to v1.1.0. IBM lists no workarounds.","status":"open","published_at":"2026-11-13T22:17:20+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","triaged_at":"2026-11-13T22:34:44+00:00","updated_at":"2026-11-13T22:35:21+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-13T22:34:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM ContextForge MCP Gateway: stored XSS lets a privileged user run scripts","impact":"medium","summary":"IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 let a privileged user embed arbitrary JavaScript in the web UI. The injected script can alter the interface and potentially disclose credentials within another user's trusted session.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["mcp","ibm-contextforge","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in users' sessions and credentials may leak","analyst_note":"Find IBM's security bulletin for CVE-2026-110199 to confirm the fixed version and any workaround; the NVD entry gives only the affected range.","how_to_check":"- Check the installed ContextForge MCP Gateway version against the affected range `1.0.0` through `1.0.11`\n- unknown for other checks; the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":4568,"output_tokens":462,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-110199 to confirm the fixed version and any workaround; the NVD entry gives only the affected range.","search":"'-110199':17A,20A '-2026':16A,19A '1.0.0':103C '1.0.11':105C '4.8':91B 'admin':10A,37B,79B 'administr':68B 'ai':26B 'ai-tool':25B 'allow':115C 'alter':129C 'arbitrari':121C 'attack':64B 'authent':81B 'base':7A 'bypass':60B 'client':53B 'client-sid':52B 'code':123C 'contextforg':2A,30B,36B,100C 'contextforge':22A 'craft':13A,72B 'credenti':85B,136C 'cross':110C 'cross-sit':109C 'cve':15A,18A 'cvss':90B 'dashboard':11A,38B 'disclosur':86B,137C 'dom':6A 'dom-bas':5A 'emb':120C 'error':42B 'fix':92B 'function':132C 'gateway':4A,24A,102C 'get':66B 'host':34B 'html':55B 'ibm':1A,21A,29B,87B,95B,99C 'ibm-contextforg':28B 'intend':131C 'javascript':76B,122C 'lead':134C 'link':14A,73B 'list':96B 'mcp':3A,23A,31B,101C 'mutat':61B 'notif':43B 'open':70B 'page':49B 'possibl':84B 'potenti':133C 'privileg':117C 'put':39B 'rate':88B 'run':75B 'sanit':56B 'script':112C 'self':33B 'self-host':32B 'session':82B,141C 'side':54B 'site':111C 'status':40B 'thus':128C 'tool':27B 'trust':140C 'ui':127C 'url':45B 'user':118C 'v1.1.0':94B 'valu':46B 'via':12A 'vulner':107C,114C 'web':126C 'within':138C 'workaround':98B 'xss':8A,62B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted IBM ContextForge MCP Gateway v1.0.0 through v1.0.11 with the admin dashboard in use. An attacker must persuade an administrator to open a crafted link, so exposure is mainly admin accounts. Teams on v1.1.0 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T22:35:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296694","run_id":3939},"products":{"at":"2026-11-13T22:35:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296694","run_id":3939},"workarounds":{"at":"2026-11-13T22:35:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296694","run_id":3939},"how_to_check":{"at":"2026-11-13T22:35:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296694","run_id":3939},"who_affected":{"at":"2026-11-13T22:35:21Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296694","run_id":3939}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["contextforgemcpgateway","ibmcontextforgemcpgateway"],"ptokens":["contextforge","gateway","ibm","mcp"],"labels":["aitooling","ibmcontextforge","mcp","medium","selfhosted"],"campaign_type":null,"search_a":"'-110199':17A,20A '-2026':16A,19A 'admin':10A 'base':7A 'contextforg':2A 'contextforge':22A 'craft':13A 'cve':15A,18A 'dashboard':11A 'dom':6A 'dom-bas':5A 'gateway':4A,24A 'ibm':1A,21A 'link':14A 'mcp':3A,23A 'via':12A 'xss':8A","search_b":"'4.8':91B 'admin':37B,79B 'administr':68B 'ai':26B 'ai-tool':25B 'attack':64B 'authent':81B 'bypass':60B 'client':53B 'client-sid':52B 'contextforg':30B,36B 'craft':72B 'credenti':85B 'cvss':90B 'dashboard':38B 'disclosur':86B 'error':42B 'fix':92B 'get':66B 'host':34B 'html':55B 'ibm':29B,87B,95B 'ibm-contextforg':28B 'javascript':76B 'link':73B 'list':96B 'mcp':31B 'mutat':61B 'notif':43B 'open':70B 'page':49B 'possibl':84B 'put':39B 'rate':88B 'run':75B 'sanit':56B 'self':33B 'self-host':32B 'session':82B 'side':54B 'status':40B 'tool':27B 'url':45B 'v1.1.0':94B 'valu':46B 'workaround':98B 'xss':62B","search_c":"'1.0.0':103C '1.0.11':105C 'allow':115C 'alter':129C 'arbitrari':121C 'code':123C 'contextforg':100C 'credenti':136C 'cross':110C 'cross-sit':109C 'disclosur':137C 'emb':120C 'function':132C 'gateway':102C 'ibm':99C 'intend':131C 'javascript':122C 'lead':134C 'mcp':101C 'potenti':133C 'privileg':117C 'script':112C 'session':141C 'site':111C 'thus':128C 'trust':140C 'ui':127C 'user':118C 'vulner':107C,114C 'web':126C 'within':138C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110199","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110199","severity":null,"published_at":"2026-11-13T22:17:20+00:00","modified_at":"2026-11-13T22:17:20+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","fetched_at":"2026-11-13T22:33:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110199:3939","url":"https://www.ibm.com/support/pages/node/7296694","severity":null,"published_at":"2026-11-13T22:35:21+00:00","modified_at":"2026-11-13T22:35:21+00:00","first_seen_at":"2026-11-13T22:35:21+00:00","fetched_at":"2026-11-13T22:35:21+00:00","note":"IBM bulletin read: affected v1.0.0-v1.0.11, fixed v1.1.0, no workaround. Bulletin says DOM-based mXSS in admin dashboard via URL values; needs admin to open crafted link (CVSS 4.8, UI:R). No exploitation or PoC checked beyond bulletin.","cites":["https://www.ibm.com/support/pages/node/7296694"]}],"documents":[{"id":150666,"url":"https://www.ibm.com/support/pages/node/7296694","title":"IBM Security Bulletin: ContextForge MCP Gateway DOM-based XSS (CVE-2026-110199)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}