IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint
Summary
| CVE | CVE-2026-77822 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-04 16:17:59 UTC |
| Updated | 2026-09-08 14:17:08 UTC |
| Description | IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding. |
Risk And Classification
Primary CVSS: v3.1 8.2 HIGH from [email protected]
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
EPSS: 0.002110000 probability, percentile 0.113160000 (date 2026-09-07)
Problem Types: CWE-918 | CWE-918 CWE-918 Server-Side Request Forgery (SSRF)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 8.2 | HIGH | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N |
| 3.1 | CNA | CVSS | 8.2 | HIGH | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | IBM | ContextForge MCP Gateway | affected <= v1.0.8 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.ibm.com/support/pages/node/7286055 | [email protected] | www.ibm.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: IBM strongly recommends addressing the vulnerability now. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM ContextForge MCP Gateway<= v1.0.8Upgrade to v1.0.9 https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9 Note: <Component A / B names> are bundled with <Product profile name> to provide <feature / function description>
Workarounds
CNA: Operators who cannot immediately upgrade can reduce exposure by: 1. **Disable A2A** — set the environment variable `MCPGATEWAY_A2A_ENABLED=False` to disable the A2A subsystem entirely. This removes the vulnerable endpoint from the attack surface at the cost of A2A functionality. 2. **Restrict A2A create/invoke permissions** — revoke A2A creation and invocation rights from developer and team_admin roles in environments where A2A is not required. 3. **Network-level egress controls** — enforce outbound network policy at the host or cloud level to block the gateway process from reaching cloud metadata endpoints and private RFC 1918 address ranges, preventing exploitation of the DNS-rebinding window even if a rebind attempt succeeds. None of these mitigations eliminate the underlying vulnerability; IBM strongly recommends upgrading to the fixed version.