Executive brief
IBM ContextForge MCP Gateway is a tool that manages REST-based integrations for AI workflows. An authenticated user can exploit a DNS rebinding vulnerability to redirect the gateway's outbound requests to internal network systems, potentially exposing sensitive data or accessing restricted resources that should not be accessible from the internet.
Technical details
The vulnerability is a server-side request forgery (SSRF) via DNS time-of-check-time-of-use (TOCTOU) weakness. The MCP Gateway validates REST tool target URLs for SSRF only during tool registration, but reuses the stored URL without re-validation or DNS pinning during subsequent tool invocation. An authenticated attacker registers a tool with a controlled hostname, then changes the DNS record after registration to point to an internal target. When the tool is invoked, the gateway resolves the hostname again, fetching the attacker's updated DNS record and sending requests to the internal address. No user interaction is required. The fix is available in v1.0.7 and higher.
Affected products
- IBM ContextForge MCP Gateway ≤ v1.0.6
Timeline
- 2026-09-02: disclosed
- 2026-07-29: patched: Fix merged in PR #5925; v1.0.7 released