{"id":"CVE-2026-110278","kind":"vulnerability","aliases":["CVE-2026-110278"],"related":[],"title":"IBM ContextForge MCP Gateway ignores per-server identity propagation setting, sending user identity to upstream MCP servers","description":"IBM ContextForge MCP Gateway 1.0.0 through 1.1.0 could allow an attacker to replay identity propagation claims signatures or expose sensitive user identity information to third-party MCP servers due to static signature payloads and missing per-gateway configuration checks during tool invocation.","summary":"IBM ContextForge MCP Gateway versions 1.0.0 through 1.1.0 sign identity propagation claims with a static payload and skip per-gateway configuration checks during tool calls. An attacker can replay those signatures or obtain sensitive user identity information sent to third-party MCP servers.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM ContextForge MCP Gateway","fixed":["1.1.1"],"affected":">= 1.0.0, <= 1.1.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ai-tooling","ibm-contextforge","mcp","self-hosted"],"not_affected_if":["identity-propagation-disabled","other-versions","v1.1.1-or-later"],"how_to_check":"- Check the ContextForge MCP Gateway version: v1.0.0 through v1.1.0 is affected, v1.1.1 is fixed.\n- Check whether identity propagation is on: IDENTITY_PROPAGATION_ENABLED=true in the gateway environment (default false), or a registered gateway with identity_propagation.enabled true. IBM says the per-server setting is ignored on tool calls and resource reads, so servers configured not to receive identity still get it. Also look at IDENTITY_SIGN_CLAIMS (HMAC-signed claims); IBM cites static signature payloads that can be replayed.","fix":"Upgrade IBM ContextForge MCP Gateway to v1.1.1 (fixing PR https://github.com/IBM/mcp-context-forge/pull/7329). If you cannot upgrade, IBM says to set IDENTITY_PROPAGATION_ENABLED=false globally so no upstream server receives user identity, and restrict gateway access to trusted users.","status":"open","published_at":"2026-11-13T22:17:20+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","triaged_at":"2026-11-13T22:34:26+00:00","updated_at":"2026-11-13T22:35:25+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-13T22:34:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM ContextForge MCP Gateway: replayed identity claims expose user identity to MCP servers","impact":"medium","summary":"IBM ContextForge MCP Gateway versions 1.0.0 through 1.1.0 sign identity propagation claims with a static payload and skip per-gateway configuration checks during tool calls. An attacker can replay those signatures or obtain sensitive user identity information sent to third-party MCP servers.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["mcp","ibm-contextforge","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker replays identity claims and reads user identity data","analyst_note":"Confirm fixed version and the identity propagation setting from the NVD entry or IBM advisory; sources give no fix.","how_to_check":"- Check the installed ContextForge MCP Gateway version against the affected range `1.0.0` through `1.1.0`\n- Review whether identity propagation to third-party MCP servers is enabled in the gateway configuration (unknown if the sources name the setting)","plain_action":"","product_name":"IBM ContextForge MCP Gateway","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Teams that run IBM ContextForge MCP Gateway in the affected versions and forward user identity claims to downstream MCP servers are exposed. Deployments on other versions, or ones that do not propagate identity to third-party MCP servers, are not described as affected by the sources.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000764,"input_tokens":4561,"output_tokens":615,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm fixed version and the identity propagation setting from the NVD entry or IBM advisory; sources give no fix.","search":"'-110278':21A,24A '-2026':20A,23A '1.0.0':44B,88C '1.1.0':46B,90C 'ai':30B 'ai-tool':29B 'allow':92C 'attack':66B,94C 'call':64B 'check':61B,124C 'claim':50B,99C 'configur':60B,123C 'contextforg':2A,34B,40B,85C 'contextforge':26A 'could':91C 'cve':19A,22A 'due':113C 'expos':102C 'gateway':4A,28A,42B,59B,87C,122C 'host':38B 'ibm':1A,25A,33B,39B,84C 'ibm-contextforg':32B 'ident':9A,14A,48B,75B,97C,105C 'ignor':5A 'inform':76B,106C 'invoc':127C 'mcp':3A,17A,27A,35B,41B,82B,86C,111C 'miss':119C 'obtain':72B 'parti':81B,110C 'payload':54B,117C 'per':7A,58B,121C 'per-gateway':57B,120C 'per-serv':6A 'propag':10A,49B,98C 'replay':68B,96C 'self':37B 'self-host':36B 'send':12A 'sensit':73B,103C 'sent':77B 'server':8A,18A,83B,112C 'set':11A 'sign':47B 'signatur':70B,100C,116C 'skip':56B 'static':53B,115C 'third':80B,109C 'third-parti':79B,108C 'tool':31B,63B,126C 'upstream':16A 'user':13A,74B,104C 'version':43B","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host IBM ContextForge MCP Gateway v1.0.0 to v1.1.0 and have identity propagation enabled. User ID, email, groups and teams can then be sent to upstream MCP servers that were set not to receive them, and signed claims can be replayed. Deployments with identity propagation off (the default) or on v1.1.1 can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T22:35:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296489","run_id":3938},"products":{"at":"2026-11-13T22:35:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296489","run_id":3938}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["contextforgemcpgateway","ibmcontextforgemcpgateway"],"ptokens":["contextforge","gateway","ibm","mcp"],"labels":["aitooling","high","ibmcontextforge","mcp","selfhosted","vendor"],"campaign_type":null,"search_a":"'-110278':21A,24A '-2026':20A,23A 'contextforg':2A 'contextforge':26A 'cve':19A,22A 'gateway':4A,28A 'ibm':1A,25A 'ident':9A,14A 'ignor':5A 'mcp':3A,17A,27A 'per':7A 'per-serv':6A 'propag':10A 'send':12A 'server':8A,18A 'set':11A 'upstream':16A 'user':13A","search_b":"'1.0.0':44B '1.1.0':46B 'ai':30B 'ai-tool':29B 'attack':66B 'call':64B 'check':61B 'claim':50B 'configur':60B 'contextforg':34B,40B 'gateway':42B,59B 'host':38B 'ibm':33B,39B 'ibm-contextforg':32B 'ident':48B,75B 'inform':76B 'mcp':35B,41B,82B 'obtain':72B 'parti':81B 'payload':54B 'per':58B 'per-gateway':57B 'propag':49B 'replay':68B 'self':37B 'self-host':36B 'sensit':73B 'sent':77B 'server':83B 'sign':47B 'signatur':70B 'skip':56B 'static':53B 'third':80B 'third-parti':79B 'tool':31B,63B 'user':74B 'version':43B","search_c":"'1.0.0':88C '1.1.0':90C 'allow':92C 'attack':94C 'check':124C 'claim':99C 'configur':123C 'contextforg':85C 'could':91C 'due':113C 'expos':102C 'gateway':87C,122C 'ibm':84C 'ident':97C,105C 'inform':106C 'invoc':127C 'mcp':86C,111C 'miss':119C 'parti':110C 'payload':117C 'per':121C 'per-gateway':120C 'propag':98C 'replay':96C 'sensit':103C 'server':112C 'signatur':100C,116C 'static':115C 'third':109C 'third-parti':108C 'tool':126C 'user':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110278","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110278","severity":null,"published_at":"2026-11-13T22:17:20+00:00","modified_at":"2026-11-13T22:17:21+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","fetched_at":"2026-11-13T22:33:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110278:3938","url":"https://www.ibm.com/support/pages/node/7296489","severity":null,"published_at":"2026-11-13T22:35:25+00:00","modified_at":"2026-11-13T22:35:25+00:00","first_seen_at":"2026-11-13T22:35:25+00:00","fetched_at":"2026-11-13T22:35:25+00:00","note":"Read IBM bulletin (node/7296489): affected v1.0.0-v1.1.0, fixed v1.1.1, workaround IDENTITY_PROPAGATION_ENABLED=false. Not exploited, no PoC seen. Skipped social search (obscure).","cites":["https://www.ibm.com/support/pages/node/7296489","https://cdn.jsdelivr.net/gh/ibm/mcp-context-forge@main/docs/docs/manage/identity-propagation.md"]}],"documents":[{"id":150665,"url":"https://www.ibm.com/support/pages/node/7296489","title":"IBM Security Bulletin: ContextForge MCP Gateway information exposure","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":150667,"url":"https://cdn.jsdelivr.net/gh/ibm/mcp-context-forge@main/docs/docs/manage/identity-propagation.md","title":"ContextForge Identity Propagation docs","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}