Executive brief
IBM ContextForge's Translate utility, a development tool that bridges HTTP clients to AI model context protocol servers, contains a session isolation flaw that allows one client to access another client's credentials and data. When multiple clients connect to a shared subprocess environment (a 30-second restart window allows this), the second client's requests can execute under the first client's authentication credentials, exposing sensitive information and enabling unauthorized actions. This vulnerability only affects the Translate service when explicitly enabled with the dynamic environment flag and is not suitable for production use.
Technical details
The vulnerability is a credential context confusion issue (CWE-488) in the Translate service component (`mcpgateway/translate.py`) that occurs when the `--enable-dynamic-env` flag is active. The Translate service maps HTTP request headers (such as Authorization headers) into subprocess environment variables for a single shared stdio-based subprocess. Due to a 30-second restart limiter, a second connected client can have its request executed under the first client's credential-derived environment, resulting in cross-client data exposure and privilege confusion. The attack requires network access to the Translate service endpoint and no authentication bypass; the vulnerability exploits improper session isolation in multi-client scenarios. IBM has published a fix (PR #6388) updating documentation to restrict the Translate service to local, single-session development only and recommends removing it from any production or multi-client deployment immediately.
Affected products
- IBM ContextForge MCP Gateway - Translate utility <= 1.0.8
Timeline
- 2026-09-04: disclosed: IBM Security Bulletin published
- 2026-08-24: patched: Fix merged in PR #6388 (documentation update enforcing development-only use)
- 2026-09-02: other: Initial IBM publication date