Answer in brief
CVE-2026-53708 records a Medium severity (CVSS 6.6) vulnerability in ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`). The current sources do not mark it as known exploited. The current feed maps IBM/mcp-context-forge (generic), IBM/mcp-contextforge-gateway (generic), mcp-contextforge-gateway (pip). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.6. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps IBM/mcp-context-forge (generic), IBM/mcp-contextforge-gateway (generic), mcp-contextforge-gateway (pip). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| IBM/mcp-context-forgegeneric | <1.0.3 | 1.0.3 |
| IBM/mcp-contextforge-gatewaygeneric | <1.0.3 | 1.0.3 |
| mcp-contextforge-gatewaypip | <1.0.3 | 1.0.3 |
Published upstream
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 14, 2026
ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validate_gateway_test_url() in mcpgateway/common/validators.py to resolve and reject private, loopback, link-local, and cloud-metadata addresses, but ResilientHttpClient later resolves the original hostname again without binding the validated address. When MCPGATEWAY_ADMIN_API_ENABLED is enabled, an attacker with a database-backed role containing explicit gateways.read permission can use DNS rebinding to return a public address during validation and a private or metadata address during connection, bypassing ssrf_blocked_networks and ssrf_dns_fail_closed because those controls apply only to the validation-time result. The endpoint's allow_admin_bypass=False setting means a bootstrap-only virtual platform-admin identity without a database role is not sufficient. Successful exploitation can reach internal services and cloud metadata, expose cloud credentials, access internal APIs, or probe internal network ports. This issue is fixed in version 1.0.3.
Quoted source text, attributed separately from HOL analysis.