CVE-2026-78573
CriticalCVSS 9.8Summary
IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.7 allow a remote attacker to gain administrative access due to the use of default credentials.
Risk Assessment
An attacker could log in to the administrative account using default credentials and take control of the MCP gateway.
Recommendation
Immediately change default credentials and upgrade ContextForge MCP Gateway to a version newer than 1.0.7.
Other vulnerabilities in IBM ContextForge MCP Gateway
See all- CVE-2026-18489High
IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.
- CVE-2026-18486High
IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters.
- CVE-2026-77822High
IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.
Original NVD description (English source)
IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.