Vulnerability · Published Sep 15, 2026 · Assigned by ibm
CVE-2026-11918IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures
Medium 5.4
In plain English
A medium-severity security flaw in ContextForge MCP Gateway from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 80.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IBM | ContextForge MCP Gateway | <= v1.0.4 |
Weakness: CWE-184 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References
- https://www.ibm.com/support/pages/node/7285720 vendor-advisory, patch