# CVE-2026-77822: IBM ContextForge MCP Gateway server-side request forgery in A2A endpoint

Source: https://junglewise.ai/threats/cve-2026-77822-ibm-contextforge-mcp-gateway-server-side-request-forgery-in-a2a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-77822 · Severity: high · CVSS 8.2 · Published 2026-09-04

IBM ContextForge MCP Gateway is an integration platform that orchestrates connections between various applications and services. The vulnerability allows authenticated users to exploit a DNS-rebinding flaw in the Agent-to-Agent invocation endpoint to bypass security controls and retrieve sensitive information from internal network resources that should be inaccessible, potentially exposing confidential data or enabling lateral movement within an organization's network.

Technologies: [IBM Contextforge](https://junglewise.ai/threats/technologies/contextforge), [IBM ContextForge MCP Gateway](https://junglewise.ai/threats/technologies/contextforge-mcp-gateway). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-77822 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77822 being exploited in the wild.

**How severe is CVE-2026-77822?** High severity, with a CVSS score of 8.2, published 4 September 2026.

**Which products and versions are affected?** IBM ContextForge MCP Gateway ≤ v1.0.8.

**Is there a fix for CVE-2026-77822?** A patch was published on 2026-09-02: Fix released in v1.0.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77822 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77822?** Check whether you run IBM Contextforge or IBM ContextForge MCP Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a server-side request forgery (SSRF) vulnerability in the A2A (Agent-to-Agent) invocation endpoint at POST /a2a/{agent_name}/invoke, exploitable via DNS rebinding. Unlike other egress paths in the gateway, the A2A endpoint does not pin DNS-resolved IP addresses at connection time, allowing an authenticated low-privileged attacker to rebind a hostname during the request and force the gateway to issue HTTP requests to internal network resources (RFC 1918 addresses, cloud metadata endpoints). The attacker receives the full response body, enabling information disclosure. Authentication is required but the attack succeeds against low-privilege roles. A patch is available in v1.0.9; workarounds include disabling A2A, restricting permissions, or enforcing network-level egress controls.

## Affected products

- IBM ContextForge MCP Gateway ≤ v1.0.8

## Timeline

- 2026-09-04: disclosed
- 2026-09-02: patched: Fix released in v1.0.9

## References

- [https://www.ibm.com/support/pages/node/7286055](https://www.ibm.com/support/pages/node/7286055)

## Related threats

- [IBM ContextForge MCP Gateway denial of service in tool slug normalization](https://junglewise.ai/threats/cve-2026-18484-ibm-contextforge-mcp-gateway-1-0-0-through-1-0-11-could-allow-a)
- [IBM ContextForge MCP Gateway server-side request forgery in OAuth registration](https://junglewise.ai/threats/cve-2026-8355-ibm-contextforge-mcp-gateway-0-1-0-through-1-0-5-is-vulnerable-to)
- [IBM ContextForge MCP Gateway path traversal in Admin API](https://junglewise.ai/threats/cve-2026-77825-ibm-contextforge-mcp-gateway-1-0-0-through-1-0-8-was-vulnerable)
- [IBM ContextForge MCP Gateway protection bypass in nested payload inspection](https://junglewise.ai/threats/cve-2026-11918-ibm-contextforge-mcp-gateway-protection-bypass-in-nested-payload)
- [IBM ContextForge MCP Gateway default credentials auth bypass](https://junglewise.ai/threats/cve-2026-78573-ibm-contextforge-mcp-gateway-default-credentials-auth-bypass)