IBM ContextForge MCP Gateway is affected by an authorization bypass vulnerability
Summary
| CVE | CVE-2026-110195 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-13 22:17:20 UTC |
| Updated | 2026-11-13 22:17:20 UTC |
| Description | IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow an authenticated caller to bypass upstream credential-level authorization policies due to an insufficiently specific cache key in the RFC 8693 token exchange cache, enabling reuse of cached upstream bearer tokens across different credentials belonging to the same user. |
Risk And Classification
Primary CVSS: v3.1 5.4 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.002310000 probability, percentile 0.140580000 (date 2026-11-14)
Problem Types: CWE-287 | CWE-287 CWE-287 Improper Authentication
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 5.4 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| 3.1 | CNA | CVSS | 5.4 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | IBM | ContextForge MCP Gateway | affected 1.0.0 1.0.11 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.ibm.com/support/pages/node/7296695 | [email protected] | www.ibm.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: This vulnerability was reported to IBM by Nick Simpson. (en)
Additional Advisory Data
Solutions
CNA: IBM strongly recommends addressing the vulnerability now. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM ContextForge MCP Gatewayv1.1.0Install or upgrade to v1.1.0 [ v1.1.0 Release Notes https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.0 ]
Workarounds
CNA: IBM strongly recommends upgrading to the fixed version. If this cannot be done, ensure authorization policies for upstream MCP servers assign identical scopes and permissions to all credential types (interactive session JWTs and API tokens) for a given account, or avoid configuring OAuth token exchange with `subject_token_source=inbound_user_jwt` across mixed credential types until the gateway is updated.