High · 8.2 CVE-2026-77822 EUVD-2026-71256GHSA-2pmv-2qcc-jcgq

IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint

Published Sep 4, 2026 · Updated Sep 4, 2026 · Assigned by ibm

Vendor: IBM Product: ContextForge MCP Gateway

Description

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.

Affected products

Vendor	Product	Affected	Fixed
IBM	ContextForge MCP Gateway	<= v1.0.8	—

References

https://www.ibm.com/support/pages/node/7286055 vendor-advisory patch