CVE-2026-77822: CWE-918 Server-Side Request Forgery (SSRF) in IBM ContextForge MCP Gateway

IBM ContextForge MCP Gateway contains a server-side request forgery (SSRF) vulnerability identified as CVE-2026-77822 (CWE-918). The flaw arises from improper handling of DNS rebinding, which allows a remote authenticated attacker with low privileges to coerce the server into making unauthorized requests, potentially exposing sensitive information. The CVSS v3.1 base score is 8.2, reflecting network attack vector, high impact on confidentiality and integrity, and no impact on availability. No vendor advisory or patch details have been published as of the current data.

An attacker with valid authentication and low privileges can exploit this SSRF vulnerability to cause the server to make unauthorized requests, potentially leading to disclosure of sensitive information. The integrity and confidentiality of data could be compromised, but availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor IBM's security advisories for updates. Given the requirement for authentication and high attack complexity, prioritize applying any future patches promptly once released.