CVE-2026-8355: IBM ContextForge MCP Gateway server-side request forgery in OAuth registration

CVE-2026-8355 · Severity: info · Published 2026-10-20

IBM ContextForge MCP Gateway is a service that integrates with AI assistants by connecting to external services through configurable gateways. An authenticated attacker with gateway creation privileges can bypass security controls during OAuth setup to trick the application into making HTTP requests to internal network resources, cloud metadata services, or local endpoints, potentially exposing sensitive data like AWS credentials or internal service information.

Technologies: IBM ContextForge MCP Gateway. Vendors: IBM.

Quick answers

Is CVE-2026-8355 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-8355 being exploited in the wild.
How severe is CVE-2026-8355?
Informational severity, published 20 October 2026.
Which products and versions are affected?
IBM ContextForge MCP Gateway 0.1.0 through 1.0.5.
Is there a fix for CVE-2026-8355?
Yes: fixed in 1.0.6 or later. Until then: Remove the gateways.create permission from untrusted roles, and enforce network-level egress filtering to block outbound traffic from the gateway host to cloud metadata addresses (169.254.254.169/32, fd00:ec2::254/128), RFC 1918 ranges, and loopback (127.0.0.0/8). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8355 attacked?
It is attacked over the network.
Am I affected by CVE-2026-8355?
Check whether you run IBM ContextForge MCP Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 1.0.6 or later

Remove the gateways.create permission from untrusted roles, and enforce network-level egress filtering to block outbound traffic from the gateway host to cloud metadata addresses (169.254.254.169/32, fd00:ec2::254/128), RFC 1918 ranges, and loopback (127.0.0.0/8).

Technical details

A server-side request forgery (SSRF) vulnerability exists in OAuth gateway registration where the oauth_config.token_url, redirect_uri, and jwks_uri parameters are not validated against SSRF protections, unlike the gateway.url field. An authenticated attacker with gateways.create permission can supply a malicious token_url pointing to cloud metadata endpoints, RFC 1918 ranges, or loopback services; the application performs an immediate HTTP POST with form-encoded credentials, and up to 256 characters of the response are reflected in an HTTP 502 error message.

Affected products

  • IBM ContextForge MCP Gateway 0.1.0 through 1.0.5

Timeline

  • 2026-08-31: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.