Skip to content
OpenAdvisories

Product · IBM

mcp-context-forge

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-53709

    MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery

    MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform ad…

    IBM mcp-context-forge
  • Critical 10.0
    CVE-2026-53710

    MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

    MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr through safe_built…

    IBM mcp-context-forge mcp-contextforge-gateway PyPI