IBM mcp-context-forge vulnerabilities

Newest CVEs

• CVE-2026-53711

  MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI

  IBM · mcp-context-forge

  Medium5.1
• CVE-2026-53709

  MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery

  IBM · mcp-context-forge

  Critical9.8
• CVE-2026-53710

  MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

  IBM · mcp-context-forge

  Critical10.0
• CVE-2026-53708

  ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

  IBM · mcp-context-forge

  Medium6.6