{"id":"CVE-2026-94407","kind":"vulnerability","aliases":["CVE-2026-94407"],"related":[],"title":"IBM ContextForge MCP Gateway: regex in tool schemas can stall the gateway","description":"IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is potentially vulnerable to denial of service due to uncontrolled regular expression complexity (CWE-400 / ReDoS). An authenticated user with tool-registration privileges can embed catastrophically backtracking regex patterns in a tool's JSON Schema `pattern` field; when ContextForge validates arguments against that schema, the validation call may consume unbounded CPU, potentially degrading gateway availability.","summary":"IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 validates tool arguments against a JSON Schema pattern supplied at tool registration, and a crafted catastrophic-backtracking regex can make that validation consume unbounded CPU. An authenticated user with tool-registration privileges can therefore degrade or take down gateway availability.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM ContextForge MCP Gateway","fixed":["1.1.0"],"affected":">= 1.0.0, <= 1.0.11","ecosystem":"vendor"}],"ecosystems":[],"tags":["ai-tooling","ibm-contextforge","mcp","self-hosted"],"not_affected_if":["no-tool-registration-by-users","version-outside-range"],"how_to_check":"- Check the installed ContextForge version: affected if it is v1.0.0 through v1.0.11; v1.1.0 is the fixed release.\n- Review which accounts can register tools or prompts, and which federated remote MCP servers you connect to: IBM says schemas from tool/prompt authors or federated remote MCP servers are evaluated without a time bound.\n- IBM states no workarounds; reducing who can register tools only limits exposure.","fix":"Upgrade IBM ContextForge MCP Gateway to v1.1.0. IBM lists no workarounds.","status":"open","published_at":"2026-11-13T22:17:27+00:00","first_seen_at":"2026-11-13T22:33:35+00:00","triaged_at":"2026-11-13T22:34:30+00:00","updated_at":"2026-11-13T22:35:19+00:00","category":"ai-tooling","confidence":0.9,"triage":{"at":"2026-11-13T22:34:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM ContextForge MCP Gateway: regex in tool schemas can stall the gateway","impact":"low","summary":"IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 validates tool arguments against a JSON Schema pattern supplied at tool registration, and a crafted catastrophic-backtracking regex can make that validation consume unbounded CPU. An authenticated user with tool-registration privileges can therefore degrade or take down gateway availability.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["mcp","ibm-contextforge","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"gateway becomes slow or unavailable through CPU exhaustion","analyst_note":"Find the vendor advisory or fixed version for ContextForge 1.0.x beyond the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-94407); the sources give no fix.","how_to_check":"- Check whether the installed ContextForge version falls in `1.0.0` through `1.0.11`.\n- Review which accounts hold tool-registration privileges on the gateway.\n- unknown for other checks; the sources do not name configuration files or settings.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range","no-tool-registration-by-users"],"who_is_affected":"Teams running IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 where users can register tools. The exposure comes from the tool JSON Schema pattern field being validated with regex. Deployments where only trusted administrators register tools carry less risk, and deployments on versions outside the range are not in scope.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000796,"input_tokens":4635,"output_tokens":665,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Find the vendor advisory or fixed version for ContextForge 1.0.x beyond the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-94407); the sources give no fix.","search":"'-2026':14A,17A '-400':103C '-94407':15A,18A '1.0.0':37B,86C '1.0.11':39B,88C 'ai':24B 'ai-tool':23B 'argument':42B,130C 'authent':67B,106C 'avail':81B,144C 'backtrack':57B,116C 'call':136C 'catastroph':56B,115C 'catastrophic-backtrack':55B 'complex':101C 'consum':63B,138C 'contextforg':2A,28B,34B,83C,128C 'contextforge':20A 'cpu':65B,140C 'craft':54B 'cve':13A,16A 'cwe':102C 'degrad':76B,142C 'denial':93C 'due':96C 'emb':114C 'express':100C 'field':126C 'gateway':4A,12A,22A,36B,80B,85C,143C 'host':32B 'ibm':1A,19A,27B,33B,82C 'ibm-contextforg':26B 'json':45B,123C 'make':60B 'may':137C 'mcp':3A,21A,29B,35B,84C 'pattern':47B,118C,125C 'potenti':90C,141C 'privileg':73B,112C 'redo':104C 'regex':5A,58B,117C 'registr':51B,72B,111C 'regular':99C 'schema':8A,46B,124C,133C 'self':31B 'self-host':30B 'servic':95C 'stall':10A 'suppli':48B 'take':78B 'therefor':75B 'tool':7A,25B,41B,50B,71B,110C,121C 'tool-registr':70B,109C 'unbound':64B,139C 'uncontrol':98C 'user':68B,107C 'valid':40B,62B,129C,135C 'vulner':91C","nicknames":[],"mitigations":[],"who_affected":"Teams self-hosting IBM ContextForge MCP Gateway v1.0.0 through v1.0.11. The gateway validates tool arguments, tool results and prompt arguments against JSON Schemas supplied by tool and prompt authors or federated remote MCP servers, and an unbounded regex in a pattern field can exhaust CPU on a gateway worker. An authenticated user with tool-registration privileges is needed; deployments where only trusted admins register tools and that connect no untrusted remote servers carry less risk.","tier":"B","verified":{"fix":{"at":"2026-11-13T22:35:19Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296667","run_id":3936},"products":{"at":"2026-11-13T22:35:19Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296667","run_id":3936},"mitigations":{"at":"2026-11-13T22:35:19Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296667","run_id":3936},"workarounds":{"at":"2026-11-13T22:35:19Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296667","run_id":3936},"how_to_check":{"at":"2026-11-13T22:35:19Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296667","run_id":3936},"who_affected":{"at":"2026-11-13T22:35:19Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7296667","run_id":3936}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["contextforgemcpgateway","ibmcontextforgemcpgateway"],"ptokens":["contextforge","gateway","ibm","mcp"],"labels":["aitooling","ibmcontextforge","mcp","medium","selfhosted"],"campaign_type":null,"search_a":"'-2026':14A,17A '-94407':15A,18A 'contextforg':2A 'contextforge':20A 'cve':13A,16A 'gateway':4A,12A,22A 'ibm':1A,19A 'mcp':3A,21A 'regex':5A 'schema':8A 'stall':10A 'tool':7A","search_b":"'1.0.0':37B '1.0.11':39B 'ai':24B 'ai-tool':23B 'argument':42B 'authent':67B 'avail':81B 'backtrack':57B 'catastroph':56B 'catastrophic-backtrack':55B 'consum':63B 'contextforg':28B,34B 'cpu':65B 'craft':54B 'degrad':76B 'gateway':36B,80B 'host':32B 'ibm':27B,33B 'ibm-contextforg':26B 'json':45B 'make':60B 'mcp':29B,35B 'pattern':47B 'privileg':73B 'regex':58B 'registr':51B,72B 'schema':46B 'self':31B 'self-host':30B 'suppli':48B 'take':78B 'therefor':75B 'tool':25B,41B,50B,71B 'tool-registr':70B 'unbound':64B 'user':68B 'valid':40B,62B","search_c":"'-400':103C '1.0.0':86C '1.0.11':88C 'argument':130C 'authent':106C 'avail':144C 'backtrack':116C 'call':136C 'catastroph':115C 'complex':101C 'consum':138C 'contextforg':83C,128C 'cpu':140C 'cwe':102C 'degrad':142C 'denial':93C 'due':96C 'emb':114C 'express':100C 'field':126C 'gateway':85C,143C 'ibm':82C 'json':123C 'may':137C 'mcp':84C 'pattern':118C,125C 'potenti':90C,141C 'privileg':112C 'redo':104C 'regex':117C 'registr':111C 'regular':99C 'schema':124C,133C 'servic':95C 'tool':110C,121C 'tool-registr':109C 'unbound':139C 'uncontrol':98C 'user':107C 'valid':129C,135C 'vulner':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94407","severity":null,"published_at":"2026-11-13T22:17:27+00:00","modified_at":"2026-11-13T22:17:27+00:00","first_seen_at":"2026-11-13T22:33:35+00:00","fetched_at":"2026-11-13T22:33:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-94407:3936","url":"https://www.ibm.com/support/pages/node/7296667","severity":null,"published_at":"2026-11-13T22:35:19+00:00","modified_at":"2026-11-13T22:35:19+00:00","first_seen_at":"2026-11-13T22:35:19+00:00","fetched_at":"2026-11-13T22:35:19+00:00","note":"IBM bulletin (node/7296667) read: affected v1.0.0-v1.0.11, fix v1.1.0, no workarounds. X not checked (tier B).","cites":["https://www.ibm.com/support/pages/node/7296667"]}],"documents":[{"id":150668,"url":"https://www.ibm.com/support/pages/node/7296667","title":"IBM Security Bulletin: ContextForge MCP Gateway regular expression denial of service","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}