CVE-2026-53710: IBM mcp-contextforge-gateway RestrictedPython sandbox bypass via getattr

CVE-2026-53710 · Severity: critical · CVSS 10 · Published 2026-09-15

IBM's ContextForge MCP server includes a Python sandbox intended to safely execute untrusted code, but a combination of three weaknesses allows unauthenticated attackers to escape the sandbox and execute arbitrary OS commands with server privileges. If the sandbox server is exposed over HTTP without proper authentication, an attacker can gain a foothold on the host system or pivot to internal networks.

Vendors: PyPI.

Quick answers

Is CVE-2026-53710 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53710 being exploited in the wild.
How severe is CVE-2026-53710?
Critical severity, with a CVSS score of 10, published 15 September 2026.
Which products and versions are affected?
mcp-contextforge-gateway (PyPI) <= 1.0.1, ECOSYSTEM:introduced=0,fixed=1.0.2.
Is there a fix for CVE-2026-53710?
Yes. mcp-contextforge-gateway (PyPI): upgrade to 1.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53710 attacked?
It is attacked over the network.
Am I affected by CVE-2026-53710?
Check whether you run mcp-contextforge-gateway (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp-contextforge-gateway (PyPI): upgrade to 1.0.2 or later
    pip install "mcp-contextforge-gateway>=1.0.2"

Technical details

The vulnerability is a RestrictedPython sandbox escape in the `python_sandbox_server` sub-project caused by three compounding weaknesses: (1) the raw `getattr` builtin is exposed in `safe_builtins`, bypassing RestrictedPython's `_getattr_` mediation mechanism; (2) the `validate_code` function only checks for literal dunder strings (e.g., `__class__`), but attackers construct dunder names at runtime (e.g., `'__cla' + 'ss__'`) to evade detection; (3) the `execute_code` MCP tool is exposed over HTTP/SSE with no authentication layer. An attacker with network access to the endpoint can craft Python code that uses `getattr` to traverse the object class hierarchy, locate `subprocess.Popen`, and execute arbitrary OS commands. The patch (version 1.0.2+) removes raw `getattr`/`setattr` from `safe_builtins`, implements policy-controlled `_guarded_getattr` and `_guarded_setattr` functions, strengthens validation using AST walk instead of substring matching, and adds mandatory Bearer token authentication via `SANDBOX_API_TOKEN` environment variable.

Affected products

  • IBM mcp-contextforge-gateway <= 1.0.1

Identifiers

  • CVE-2026-53710
  • GHSA-xm98-3vcf-fph7
  • PYSEC-2026-3862

Timeline

  • 2026-08-24: disclosed: Vulnerability disclosed in GitHub Security Advisory GHSA-xm98-3vcf-fph7
  • 2026-05-25: patched: Patch merged in commit 63a2900; version 1.0.2 released with fixes including guarded attribute access, improved validation, and HTTP authentication
  • 2026-08-24: advisory: GitHub Advisory Database entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.