mcp-context-forge vulnerabilities

2 known vulnerabilities in mcp-context-forge from IBM. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  mcp-context-forge: Improper Authentication

  CVE-2026-53709Oct 13, 2026IBM

  MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform adm

• 10.0 Critical severity

  mcp-context-forge: Improper Control of Generation of Code

  CVE-2026-53710Sep 15, 2026IBMEPSS 1.14%

  MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr through safe_builti