Quick answers
- Is CVE-2026-77822 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77822 being exploited in the wild.
- How severe is CVE-2026-77822?
- High severity, with a CVSS score of 8.2, published 4 September 2026.
- Which products and versions are affected?
- IBM ContextForge MCP Gateway ≤ v1.0.8.
- Is there a fix for CVE-2026-77822?
- A patch was published on 2026-09-02: Fix released in v1.0.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-77822 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-77822?
- Check whether you run IBM Contextforge or IBM ContextForge MCP Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a server-side request forgery (SSRF) vulnerability in the A2A (Agent-to-Agent) invocation endpoint at POST /a2a/{agent_name}/invoke, exploitable via DNS rebinding. Unlike other egress paths in the gateway, the A2A endpoint does not pin DNS-resolved IP addresses at connection time, allowing an authenticated low-privileged attacker to rebind a hostname during the request and force the gateway to issue HTTP requests to internal network resources (RFC 1918 addresses, cloud metadata endpoints). The attacker receives the full response body, enabling information disclosure. Authentication is required but the attack succeeds against low-privilege roles. A patch is available in v1.0.9; workarounds include disabling A2A, restricting permissions, or enforcing network-level egress controls.
Affected products
- IBM ContextForge MCP Gateway ≤ v1.0.8
Timeline
- 2026-09-04: disclosed
- 2026-09-02: patched: Fix released in v1.0.9