Answer in brief
CVE-2026-53710 records a Critical severity (CVSS 10.0) vulnerability in MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server. The current sources do not mark it as known exploited. The current feed maps IBM/mcp-context-forge (generic), mcp-contextforge-gateway (pip), mcp-contextforge-gateway (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 10.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps IBM/mcp-context-forge (generic), mcp-contextforge-gateway (pip), mcp-contextforge-gateway (pypi). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| IBM/mcp-context-forgegeneric | <1.0.2 | 1.0.2 |
| mcp-contextforge-gatewaypip | <=1.0.1 | 1.0.2 |
| mcp-contextforge-gatewaypypi | >=0 <1.0.2 | 1.0.2 |
Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 26, 2026
MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr through safe_builtins, omits a required _getattr_ guard, and relies on validate_code checks for literal dangerous dunder strings. An attacker can construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands with the server process privileges through the execute_code MCP tool. The HTTP/SSE transport can expose this tool without authentication, while stdio-only deployments have reduced network reachability. The issue affects the python_sandbox_server subproject and does not directly affect the core Context Forge gateway or proxy components. This issue is fixed in version 1.0.2.
Quoted source text, attributed separately from HOL analysis.