{"id":"CVE-2026-110279","kind":"vulnerability","aliases":["CVE-2026-110279"],"related":[],"title":"IBM ContextForge MCP Gateway: header overrides upstream credentials, bypassing per-user permissions","description":"IBM ContextForge MCP Gateway 1.0.0 through 1.1.0 is vulnerable to improper credential handling because the X-Upstream-Authorization request header can override the gateway-managed upstream credential for OAuth (authorization_code and client_credentials), bearer and basic authenticated gateways, which could allow an authenticated user to cause upstream requests to be made with a different credential and bypass per-user permission and audit attribution.","summary":"IBM ContextForge MCP Gateway versions 1.0.0 through 1.1.0 let the X-Upstream-Authorization request header replace the gateway-managed credential used for upstream calls. An authenticated user can make upstream requests under a different credential, bypassing per-user permissions and audit attribution.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM ContextForge MCP Gateway","fixed":["1.1.1"],"affected":">= 1.0.0, <= 1.1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["ai-tooling","ibm-contextforge","mcp","self-hosted"],"not_affected_if":["no-upstream-auth-configured","outside-affected-range"],"how_to_check":"- Check installed ContextForge MCP Gateway version: affected is v1.0.0 through v1.1.0; fixed in v1.1.1\n- Check whether any gateway uses auth_type oauth (authorization_code or client_credentials), bearer, basic or authheaders; those are the affected modes\n- Check whether clients can send X-Upstream-Authorization through your proxy to MCP endpoints","fix":"Upgrade IBM ContextForge MCP Gateway to v1.1.1 (fix PR IBM/mcp-context-forge#7341). Workaround if you cannot upgrade: remove the X-Upstream-Authorization request header at the reverse proxy or API gateway in front of ContextForge for all MCP endpoints, and restrict network access to MCP endpoints to trusted networks.","status":"open","published_at":"2026-11-13T22:17:21+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","triaged_at":"2026-11-13T22:34:22+00:00","updated_at":"2026-11-13T22:35:18+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-13T22:34:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM ContextForge MCP Gateway: header overrides upstream credentials, bypassing per-user permissions","impact":"medium","summary":"IBM ContextForge MCP Gateway versions 1.0.0 through 1.1.0 let the X-Upstream-Authorization request header replace the gateway-managed credential used for upstream calls. An authenticated user can make upstream requests under a different credential, bypassing per-user permissions and audit attribution.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["mcp","ibm-contextforge","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"upstream requests run under another user's credential, bypassing permissions","analyst_note":"Confirm the fixed version and any vendor workaround from the IBM security bulletin for CVE-2026-110279.","how_to_check":"- Check the installed ContextForge MCP Gateway version against the affected range `1.0.0` through `1.1.0`\n- Look for OAuth, bearer or basic upstream authentication configured on gateways, since those are the affected modes","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["outside-affected-range","no-upstream-auth-configured"],"who_is_affected":"Teams running IBM ContextForge MCP Gateway between 1.0.0 and 1.1.0 with gateway-managed upstream credentials (OAuth authorization_code or client_credentials, bearer, or basic) are exposed. Any authenticated user of the gateway can exploit it, so deployments with a single trusted user or no gateway-managed upstream auth are lower risk. The sources do not name a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000782,"input_tokens":4607,"output_tokens":642,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any vendor workaround from the IBM security bulletin for CVE-2026-110279.","search":"'-110279':16A,19A '-2026':15A,18A '1.0.0':39B,83C '1.1.0':41B,85C 'ai':25B 'ai-tool':24B 'allow':122C 'attribut':78B,145C 'audit':77B,144C 'authent':61B,118C,124C 'author':47B,97C,110C 'basic':117C 'bearer':115C 'bypass':9A,71B,138C 'call':59B 'caus':127C 'client':113C 'code':111C 'contextforg':2A,29B,35B,80C 'contextforge':21A 'could':121C 'credenti':8A,55B,70B,90C,107C,114C,136C 'cve':14A,17A 'differ':69B,135C 'gateway':4A,23A,37B,53B,82C,104C,119C 'gateway-manag':52B,103C 'handl':91C 'header':5A,49B,99C 'host':33B 'ibm':1A,20A,28B,34B,79C 'ibm-contextforg':27B 'improp':89C 'let':42B 'made':132C 'make':64B 'manag':54B,105C 'mcp':3A,22A,30B,36B,81C 'oauth':109C 'overrid':6A,101C 'per':11A,73B,140C 'per-us':10A,72B,139C 'permiss':13A,75B,142C 'replac':50B 'request':48B,66B,98C,129C 'self':32B 'self-host':31B 'tool':26B 'upstream':7A,46B,58B,65B,96C,106C,128C 'use':56B 'user':12A,62B,74B,125C,141C 'version':38B 'vulner':87C 'x':45B,95C 'x-upstream-author':44B,94C","nicknames":[],"mitigations":[],"who_affected":"Teams self-hosting IBM ContextForge MCP Gateway 1.0.0 to 1.1.0 with gateway-managed upstream credentials (OAuth authorization_code or client_credentials, bearer, basic, or custom auth headers) are exposed. Any authenticated user can send an X-Upstream-Authorization header that replaces the stored credential, so requests run under another credential, bypassing per-user permissions and audit attribution. Deployments with no gateway-managed upstream auth, or already on 1.1.1, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T22:35:18Z","by":"analyst","doc":"https://github.com/IBM/mcp-context-forge/pull/7341","run_id":3937},"products":{"at":"2026-11-13T22:35:18Z","by":"analyst","doc":"https://github.com/IBM/mcp-context-forge/pull/7341","run_id":3937},"how_to_check":{"at":"2026-11-13T22:35:18Z","by":"analyst","doc":"https://github.com/IBM/mcp-context-forge/pull/7341","run_id":3937}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["contextforgemcpgateway","ibmcontextforgemcpgateway"],"ptokens":["contextforge","gateway","ibm","mcp"],"labels":["aitooling","high","ibmcontextforge","mcp","selfhosted"],"campaign_type":null,"search_a":"'-110279':16A,19A '-2026':15A,18A 'bypass':9A 'contextforg':2A 'contextforge':21A 'credenti':8A 'cve':14A,17A 'gateway':4A,23A 'header':5A 'ibm':1A,20A 'mcp':3A,22A 'overrid':6A 'per':11A 'per-us':10A 'permiss':13A 'upstream':7A 'user':12A","search_b":"'1.0.0':39B '1.1.0':41B 'ai':25B 'ai-tool':24B 'attribut':78B 'audit':77B 'authent':61B 'author':47B 'bypass':71B 'call':59B 'contextforg':29B,35B 'credenti':55B,70B 'differ':69B 'gateway':37B,53B 'gateway-manag':52B 'header':49B 'host':33B 'ibm':28B,34B 'ibm-contextforg':27B 'let':42B 'make':64B 'manag':54B 'mcp':30B,36B 'per':73B 'per-us':72B 'permiss':75B 'replac':50B 'request':48B,66B 'self':32B 'self-host':31B 'tool':26B 'upstream':46B,58B,65B 'use':56B 'user':62B,74B 'version':38B 'x':45B 'x-upstream-author':44B","search_c":"'1.0.0':83C '1.1.0':85C 'allow':122C 'attribut':145C 'audit':144C 'authent':118C,124C 'author':97C,110C 'basic':117C 'bearer':115C 'bypass':138C 'caus':127C 'client':113C 'code':111C 'contextforg':80C 'could':121C 'credenti':90C,107C,114C,136C 'differ':135C 'gateway':82C,104C,119C 'gateway-manag':103C 'handl':91C 'header':99C 'ibm':79C 'improp':89C 'made':132C 'manag':105C 'mcp':81C 'oauth':109C 'overrid':101C 'per':140C 'per-us':139C 'permiss':142C 'request':98C,129C 'upstream':96C,106C,128C 'user':125C,141C 'vulner':87C 'x':95C 'x-upstream-author':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110279","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110279","severity":null,"published_at":"2026-11-13T22:17:21+00:00","modified_at":"2026-11-13T22:17:21+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","fetched_at":"2026-11-13T22:33:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110279:3937","url":"https://www.ibm.com/support/pages/node/7296490","severity":null,"published_at":"2026-11-13T22:35:18+00:00","modified_at":"2026-11-13T22:35:18+00:00","first_seen_at":"2026-11-13T22:35:18+00:00","fetched_at":"2026-11-13T22:35:18+00:00","note":"IBM bulletin 7296490: affected v1.0.0-v1.1.0, fix v1.1.1, workaround: strip X-Upstream-Authorization at proxy and restrict network access to MCP endpoints. No exploitation/PoC seen. Bulletin fix table lists '2.0' in version column; fix text says v1.1.1.","cites":["https://www.ibm.com/support/pages/node/7296490","https://github.com/IBM/mcp-context-forge/pull/7341"]}],"documents":[{"id":150663,"url":"https://www.ibm.com/support/pages/node/7296490","title":"IBM Security Bulletin: ContextForge MCP Gateway improper authentication (CVE-2026-110279)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":150664,"url":"https://github.com/IBM/mcp-context-forge/pull/7341","title":"Fixing PR #7341 mcp-context-forge","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}