CVE-2026-18905 — IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation

CVE-2026-18905

IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation PUBLISHED

Description (CNA)

IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation.

Affected (CNA)

Vendor / product	Versions
IBM / ContextForge MCP Gateway (`mcp-contextforge-gateway`)	affected <= v1.0.6

CWE

CWE-918

References

https://www.ibm.com/support/pages/node/7286053

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.