Executive brief
IBM ContextForge MCP Gateway is an integration platform that orchestrates connections between various applications and services. The vulnerability allows authenticated users to exploit a DNS-rebinding flaw in the Agent-to-Agent invocation endpoint to bypass security controls and retrieve sensitive information from internal network resources that should be inaccessible, potentially exposing confidential data or enabling lateral movement within an organization's network.
Technical details
This is a server-side request forgery (SSRF) vulnerability in the A2A (Agent-to-Agent) invocation endpoint at POST /a2a/{agent_name}/invoke, exploitable via DNS rebinding. Unlike other egress paths in the gateway, the A2A endpoint does not pin DNS-resolved IP addresses at connection time, allowing an authenticated low-privileged attacker to rebind a hostname during the request and force the gateway to issue HTTP requests to internal network resources (RFC 1918 addresses, cloud metadata endpoints). The attacker receives the full response body, enabling information disclosure. Authentication is required but the attack succeeds against low-privilege roles. A patch is available in v1.0.9; workarounds include disabling A2A, restricting permissions, or enforcing network-level egress controls.
Affected products
- IBM ContextForge MCP Gateway ≤ v1.0.8
Timeline
- 2026-09-04: disclosed
- 2026-09-02: patched: Fix released in v1.0.9