Junglewise Threat Intelligence

CVE-2026-53710: IBM mcp-contextforge-gateway RestrictedPython sandbox bypass via getattr

CVE-2026-53710 · Severity: critical · CVSS 10 · Published 2026-08-24

Executive brief

IBM's ContextForge MCP server includes a Python sandbox intended to safely execute untrusted code, but a combination of three weaknesses allows unauthenticated attackers to escape the sandbox and execute arbitrary OS commands with server privileges. If the sandbox server is exposed over HTTP without proper authentication, an attacker can gain a foothold on the host system or pivot to internal networks.

Technical details

The vulnerability is a RestrictedPython sandbox escape in the `python_sandbox_server` sub-project caused by three compounding weaknesses: (1) the raw `getattr` builtin is exposed in `safe_builtins`, bypassing RestrictedPython's `_getattr_` mediation mechanism; (2) the `validate_code` function only checks for literal dunder strings (e.g., `__class__`), but attackers construct dunder names at runtime (e.g., `'__cla' + 'ss__'`) to evade detection; (3) the `execute_code` MCP tool is exposed over HTTP/SSE with no authentication layer. An attacker with network access to the endpoint can craft Python code that uses `getattr` to traverse the object class hierarchy, locate `subprocess.Popen`, and execute arbitrary OS commands. The patch (version 1.0.2+) removes raw `getattr`/`setattr` from `safe_builtins`, implements policy-controlled `_guarded_getattr` and `_guarded_setattr` functions, strengthens validation using AST walk instead of substring matching, and adds mandatory Bearer token authentication via `SANDBOX_API_TOKEN` environment variable.

Affected products

  • IBM mcp-contextforge-gateway <= 1.0.1

Timeline

  • 2026-08-24: disclosed: Vulnerability disclosed in GitHub Security Advisory GHSA-xm98-3vcf-fph7
  • 2026-05-25: patched: Patch merged in commit 63a2900; version 1.0.2 released with fixes including guarded attribute access, improved validation, and HTTP authentication
  • 2026-08-24: advisory: GitHub Advisory Database entry published

References

Related threats