{"id":"CVE-2026-18484","kind":"vulnerability","aliases":["CVE-2026-18484"],"related":[],"title":"IBM ContextForge MCP Gateway: slug collisions let an authenticated user cause denial of service","description":"IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow a remote authenticated attacker to cause a denial of service due to improper slug normalization causing tool name collisions.","summary":"In ContextForge MCP Gateway 1.0.0 to 1.0.11, a user with gateway-create permission can register a gateway whose computed tool slug collides with an existing public tool in the same team. Calls to that tool then fail with an ambiguity error for every team member until an admin intervenes. IBM rates it CVSS 6.5 and fixes it in v1.1.0.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ContextForge MCP Gateway","fixed":["1.1.0"],"affected":">= 1.0.0, <= 1.0.11","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ai-tooling","ibm-contextforge","mcp","self-hosted"],"not_affected_if":["auth-required","no-authenticated-users","unaffected-version"],"how_to_check":"Check the installed ContextForge MCP Gateway version; 1.0.0 through 1.0.11 is affected. A tools/call failing with an ambiguity error for one tool suggests an active slug collision between two gateway registrations in the same team. Workaround if you cannot upgrade: an admin renames or removes one of the two conflicting gateway registrations. No setting prevents the collision before v1.1.0 (IBM).","fix":"Upgrade IBM ContextForge MCP Gateway to v1.1.0","status":"open","published_at":"2026-11-08T18:17:04+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","triaged_at":"2026-11-08T18:22:41+00:00","updated_at":"2026-11-08T18:23:25+00:00","category":"ai-tooling","confidence":0.9,"triage":{"at":"2026-11-08T18:22:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM ContextForge MCP Gateway: slug collisions let an authenticated user cause denial of service","impact":"low","summary":"IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 normalize tool slugs improperly, so different tool names collide. A remote attacker with a valid account can use this to cause a denial of service.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["mcp","ibm-contextforge","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Gateway becomes unavailable to other users through denial of service","analyst_note":"Confirm the fixed version and any workaround from the IBM security bulletin for CVE-2026-18484; the NVD entry gives no fix.","how_to_check":"- Check the installed ContextForge MCP Gateway version against the affected range `1.0.0` through `1.0.11`\n- unknown","plain_action":"","product_name":"ContextForge MCP Gateway","needs_analyst":true,"not_affected_if":["unaffected-version","no-authenticated-users"],"who_is_affected":"Teams running IBM ContextForge MCP Gateway between versions 1.0.0 and 1.0.11 that let authenticated users register or call tools. The sources do not say which deployment settings make it reachable. unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000727,"input_tokens":4536,"output_tokens":547,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any workaround from the IBM security bulletin for CVE-2026-18484; the NVD entry gives no fix.","search":"'-18484':17A,20A '-2026':16A,19A '1.0.0':38B,98C '1.0.11':40B,100C '6.5':88B 'admin':82B 'ai':25B 'ai-tool':24B 'allow':102C 'ambigu':74B 'attack':106C 'authent':9A,105C 'call':66B 'caus':11A,108C,118C 'collid':56B 'collis':6A,121C 'comput':53B 'contextforg':2A,29B,35B,95C 'contextforge':21A 'could':101C 'creat':46B 'cve':15A,18A 'cvss':87B 'denial':12A,110C 'due':113C 'error':75B 'everi':77B 'exist':59B 'fail':71B 'fix':90B 'gateway':4A,23A,37B,45B,51B,97C 'gateway-cr':44B 'host':33B 'ibm':1A,28B,84B,94C 'ibm-contextforg':27B 'improp':115C 'interven':83B 'let':7A 'mcp':3A,22A,30B,36B,96C 'member':79B 'name':120C 'normal':117C 'permiss':47B 'public':60B 'rate':85B 'regist':49B 'remot':104C 'self':32B 'self-host':31B 'servic':14A,112C 'slug':5A,55B,116C 'team':65B,78B 'tool':26B,54B,61B,69B,119C 'user':10A,42B 'v1.1.0':93B 'whose':52B","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted ContextForge MCP Gateway 1.0.0 to 1.0.11 where more than one user can register federated gateways. The attacker needs a valid account with gateway-create permission, and the effect is availability only: one tool becomes unusable for the team. Setups where only trusted admins can create gateways carry little risk.","tier":"B","verified":{"fix":{"at":"2026-11-08T18:23:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-denial-service-tool-name-collision-through-slug-normalization","run_id":2209},"products":{"at":"2026-11-08T18:23:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-denial-service-tool-name-collision-through-slug-normalization","run_id":2209},"how_to_check":{"at":"2026-11-08T18:23:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-denial-service-tool-name-collision-through-slug-normalization","run_id":2209},"who_affected":{"at":"2026-11-08T18:23:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-denial-service-tool-name-collision-through-slug-normalization","run_id":2209}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["contextforgemcpgateway","mcpgateway"],"ptokens":["contextforge","gateway","mcp"],"labels":["aitooling","ibmcontextforge","mcp","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-18484':17A,20A '-2026':16A,19A 'authent':9A 'caus':11A 'collis':6A 'contextforg':2A 'contextforge':21A 'cve':15A,18A 'denial':12A 'gateway':4A,23A 'ibm':1A 'let':7A 'mcp':3A,22A 'servic':14A 'slug':5A 'user':10A","search_b":"'1.0.0':38B '1.0.11':40B '6.5':88B 'admin':82B 'ai':25B 'ai-tool':24B 'ambigu':74B 'call':66B 'collid':56B 'comput':53B 'contextforg':29B,35B 'creat':46B 'cvss':87B 'error':75B 'everi':77B 'exist':59B 'fail':71B 'fix':90B 'gateway':37B,45B,51B 'gateway-cr':44B 'host':33B 'ibm':28B,84B 'ibm-contextforg':27B 'interven':83B 'mcp':30B,36B 'member':79B 'permiss':47B 'public':60B 'rate':85B 'regist':49B 'self':32B 'self-host':31B 'slug':55B 'team':65B,78B 'tool':26B,54B,61B,69B 'user':42B 'v1.1.0':93B 'whose':52B","search_c":"'1.0.0':98C '1.0.11':100C 'allow':102C 'attack':106C 'authent':105C 'caus':108C,118C 'collis':121C 'contextforg':95C 'could':101C 'denial':110C 'due':113C 'gateway':97C 'ibm':94C 'improp':115C 'mcp':96C 'name':120C 'normal':117C 'remot':104C 'servic':112C 'slug':116C 'tool':119C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18484","severity":null,"published_at":"2026-11-08T18:17:04+00:00","modified_at":"2026-11-08T18:17:04+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","fetched_at":"2026-11-08T18:22:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-18484:2209","url":"https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-denial-service-tool-name-collision-through-slug-normalization","severity":null,"published_at":"2026-11-08T18:23:25+00:00","modified_at":"2026-11-08T18:23:25+00:00","first_seen_at":"2026-11-08T18:23:25+00:00","fetched_at":"2026-11-08T18:23:25+00:00","note":"IBM bulletin (27 Oct 2026) read: affected 1.0.0-1.0.11, fixed in v1.1.0; workaround is admin renaming/removing a conflicting gateway; no config prevents it. No exploitation or PoC seen; social not searched.","cites":["https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-denial-service-tool-name-collision-through-slug-normalization"]}],"documents":[{"id":102926,"url":"https://www.ibm.com/support/pages/security-bulletin-ibm-contextforge-mcp-gateway-affected-denial-service-tool-name-collision-through-slug-normalization","title":"IBM Security Bulletin: ContextForge MCP Gateway DoS via slug normalization","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}