CVE-2026-77822

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77822", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-08-21T14:36:12.469Z", "datePublished": "2026-09-04T15:15:35.403Z", "dateUpdated": "2026-09-04T18:24:58.315Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-09-04T15:15:35.403Z"}, "title": "IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "ContextForge MCP Gateway", "versions": [{"status": "affected", "version": "<= v1.0.8"}], "cpes": ["cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7286055", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 8.2, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N"}}], "workarounds": [{"lang": "en", "value": "Operators who cannot immediately upgrade can reduce exposure by:\n\n\n1. **Disable A2A** \u2014 set the environment variable `MCPGATEWAY_A2A_ENABLED=False` to disable the A2A subsystem entirely. This removes the vulnerable endpoint from the attack surface at the cost of A2A functionality.\n\n2. **Restrict A2A create/invoke permissions** \u2014 revoke A2A creation and invocation rights from developer and team_admin roles in environments where A2A is not required.\n\n3. **Network-level egress controls** \u2014 enforce outbound network policy at the host or cloud level to block the gateway process from reaching cloud metadata endpoints and private RFC 1918 address ranges, preventing exploitation of the DNS-rebinding window even if a rebind attempt succeeds.\n\n\nNone of these mitigations eliminate the underlying vulnerability; IBM strongly recommends upgrading to the fixed version.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><div>Operators who cannot immediately upgrade can reduce exposure by:</div><br/><div>1. **Disable A2A** \u2014 set the environment variable `MCPGATEWAY_A2A_ENABLED=False` to disable the A2A subsystem entirely. This removes the vulnerable endpoint from the attack surface at the cost of A2A functionality.</div><div>2. **Restrict A2A create/invoke permissions** \u2014 revoke A2A creation and invocation rights from developer and team_admin roles in environments where A2A is not required.</div><div>3. **Network-level egress controls** \u2014 enforce outbound network policy at the host or cloud level to block the gateway process from reaching cloud metadata endpoints and private RFC 1918 address ranges, preventing exploitation of the DNS-rebinding window even if a rebind attempt succeeds.</div><br/><div>None of these mitigations eliminate the underlying vulnerability; IBM strongly recommends upgrading to the fixed version.</div></div>"}]}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM ContextForge MCP Gateway<= v1.0.8Upgrade to v1.0.9\u00a0\n https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9 \n\n\n\n\n\n\n\n\u00a0Note: <Component A / B names> are bundled with <Product profile name> to provide <feature / function description>", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div></div><p><strong>IBM strongly recommends addressing the vulnerability now.</strong></p><div><table><tbody><tr><td><strong>Product(s)</strong></td><td><strong>Version(s) number and/or range\u00a0</strong></td><td><strong>Remediation/Fix/Instructions</strong></td></tr><tr><td>IBM ContextForge MCP Gateway</td><td>&lt;= v1.0.8</td><td>Upgrade to v1.0.9\u00a0\n<div><div><a href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9\" rel=\"nofollow\">https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9</a></div></div></td></tr></tbody></table></div><p>\u00a0Note: &lt;Component A / B names&gt; are bundled with &lt;Product profile name&gt; to provide &lt;feature / function description&gt;</p><p></p>"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-04T17:09:15.348543Z", "id": "CVE-2026-77822", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-04T18:24:58.315Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77822", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-04T17:09:15.348543Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-04T17:09:16.341Z"}}], "cna": {"title": "IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "ContextForge MCP Gateway", "versions": [{"status": "affected", "version": "<= v1.0.8"}]}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM ContextForge MCP Gateway<= v1.0.8Upgrade to v1.0.9\u00a0\n https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9 \n\n\n\n\n\n\n\n\u00a0Note: <Component A / B names> are bundled with <Product profile name> to provide <feature / function description>", "supportingMedia": [{"type": "text/html", "value": "<div></div><p><strong>IBM strongly recommends addressing the vulnerability now.</strong></p><div><table><tbody><tr><td><strong>Product(s)</strong></td><td><strong>Version(s) number and/or range\u00a0</strong></td><td><strong>Remediation/Fix/Instructions</strong></td></tr><tr><td>IBM ContextForge MCP Gateway</td><td>&lt;= v1.0.8</td><td>Upgrade to v1.0.9\u00a0\n<div><div><a href=\"https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9\" rel=\"nofollow\">https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9</a></div></div></td></tr></tbody></table></div><p>\u00a0Note: &lt;Component A / B names&gt; are bundled with &lt;Product profile name&gt; to provide &lt;feature / function description&gt;</p><p></p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7286055", "tags": ["vendor-advisory", "patch"]}], "workarounds": [{"lang": "en", "value": "Operators who cannot immediately upgrade can reduce exposure by:\n\n\n1. **Disable A2A** \u2014 set the environment variable `MCPGATEWAY_A2A_ENABLED=False` to disable the A2A subsystem entirely. This removes the vulnerable endpoint from the attack surface at the cost of A2A functionality.\n\n2. **Restrict A2A create/invoke permissions** \u2014 revoke A2A creation and invocation rights from developer and team_admin roles in environments where A2A is not required.\n\n3. **Network-level egress controls** \u2014 enforce outbound network policy at the host or cloud level to block the gateway process from reaching cloud metadata endpoints and private RFC 1918 address ranges, preventing exploitation of the DNS-rebinding window even if a rebind attempt succeeds.\n\n\nNone of these mitigations eliminate the underlying vulnerability; IBM strongly recommends upgrading to the fixed version.", "supportingMedia": [{"type": "text/html", "value": "<div><div>Operators who cannot immediately upgrade can reduce exposure by:</div><br/><div>1. **Disable A2A** \u2014 set the environment variable `MCPGATEWAY_A2A_ENABLED=False` to disable the A2A subsystem entirely. This removes the vulnerable endpoint from the attack surface at the cost of A2A functionality.</div><div>2. **Restrict A2A create/invoke permissions** \u2014 revoke A2A creation and invocation rights from developer and team_admin roles in environments where A2A is not required.</div><div>3. **Network-level egress controls** \u2014 enforce outbound network policy at the host or cloud level to block the gateway process from reaching cloud metadata endpoints and private RFC 1918 address ranges, preventing exploitation of the DNS-rebinding window even if a rebind attempt succeeds.</div><br/><div>None of these mitigations eliminate the underlying vulnerability; IBM strongly recommends upgrading to the fixed version.</div></div>", "base64": false}]}], "descriptions": [{"lang": "en", "value": "IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-09-04T15:15:35.403Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77822", "state": "PUBLISHED", "dateUpdated": "2026-09-04T18:24:58.315Z", "dateReserved": "2026-08-21T14:36:12.469Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-09-04T15:15:35.403Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:contextforge-mcp-gateway:*:*:*:*:*:*:*:*"], "product": "ContextForge MCP Gateway", "vendor": "IBM", "versions": [{"status": "affected", "version": "<= v1.0.8"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:contextforge:*:*:*:*:*:python:*:*", "matchCriteriaId": "7AF5E523-F344-4289-AE5E-1B1231CE6857", "versionEndIncluding": "1.0.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding."}], "id": "CVE-2026-77822", "lastModified": "2026-09-15T15:16:27.183", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.8, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77822", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-04T17:09:15.348543Z", "version": "2.0.3"}}]}, "published": "2026-09-04T16:17:59.550", "references": [{"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7286055"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.8]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ContextForge MCP Gateway", "source": "cna", "vendor": "IBM"}, "product": "contextforge_mcp_gateway", "vendor": "ibm"}], "created": "2026-09-04T16:45:05.037848+00:00", "updated": "2026-09-07T08:26:10.482530+00:00", "vendors": ["ibm", "ibm$PRODUCT$contextforge_mcp_gateway"]}