CVE-2026-18489: CWE-488 Exposure of Data Element to Wrong Session in IBM ContextForge MCP Gateway - Translate utility

CVE-2026-18489 affects IBM ContextForge MCP Gateway - Translate utility versions up to 1.0.8. The vulnerability arises from improper session data isolation, allowing a remote attacker to obtain sensitive information belonging to other sessions. This is classified under CWE-488, which concerns exposure of data elements to the wrong session. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector with high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker can remotely access sensitive information from other user sessions due to improper session data isolation. This compromises confidentiality and integrity of data handled by the affected utility. There is no impact on availability. The vulnerability does not require privileges or user interaction but has high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected utility and monitor for unusual access patterns. Follow IBM's guidance once published.