IBM Mcp-Context-Forge vulnerabilities

4 CVEs affecting IBM Mcp-Context-Forge, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-53711, published 2026-10-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-53710, published 2026-09-15. Critical severity, CVSS 10.0. EPSS: 1.1% chance of exploitation in the next 30 days. MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in…
CVE-2026-53709, published 2026-10-13. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens…
CVE-2026-53711, published 2026-10-13. Medium severity, CVSS 5.1. EPSS: 0.4% chance of exploitation in the next 30 days. MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output encoding before the…
CVE-2026-53708, published 2026-09-14. Medium severity, CVSS 6.6. EPSS: 0.4% chance of exploitation in the next 30 days. ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call…