Medium · 5.4 CVE-2026-11918 EUVD-2026-78898GHSA-x4xw-xv9j-3c3q

IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures

Published Sep 15, 2026 · Updated Sep 20, 2026 · Assigned by ibm

Vendor: IBM Product: ContextForge MCP Gateway

Description

IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content.

Affected products

Vendor	Product	Affected	Fixed
IBM	ContextForge MCP Gateway	<= v1.0.4	—

References

https://www.ibm.com/support/pages/node/7285720 vendor-advisory patch