IBM CONTEXTFORGE MCP GATEWAY · CVE-2026-110278 · AI agents & MCP
FIX → 1.1.1 ✓ verified
IBM ContextForge MCP Gateway versions 1.0.0 through 1.1.0 sign identity propagation claims with a static payload and skip per-gateway configuration checks during tool calls. An attacker can replay those signatures or obtain sensitive user identity information sent to third-party MCP servers.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host IBM ContextForge MCP Gateway v1.0.0 to v1.1.0 and have identity propagation enabled. User ID, email, groups and teams can then be sent to upstream MCP servers that were set not to receive them, and signed claims can be replayed. Deployments with identity propagation off (the default) or on v1.1.1 can skip it.
Not affected if identity-propagation-disabled, other-versions, v1.1.1-or-later
Who cares ibm-contextforge, mcp, self-hosted
Upgrade to 1.1.1
Posts are quoted with a link to the original. They are data to us, never instructions.
IBM ContextForge MCP Gateway 1.0.0 through 1.1.0 could allow an attacker to replay identity propagation claims signatures or expose sensitive user identity information to third-party MCP servers due to static signature payloads and missing per-gateway configuration checks during tool invocation.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
v1.1.1