CVE-2026-8355: CWE-918 Server-Side request forgery (SSRF) in IBM ContextForge MCP Gateway

CVE-2026-8355 is an SSRF vulnerability in IBM ContextForge MCP Gateway versions 0.1.0 through 1.0.5. It arises because the system does not validate the oauth_config.token_url parameter during OAuth-enabled gateway registration. An attacker with gateway creation privileges can specify a malicious token_url that triggers the application to send HTTP POST requests to internal network services, cloud metadata endpoints (such as AWS IMDSv1, GCP, Azure), or localhost services. The application sends form-encoded credentials in the POST body. If the response is not a valid OAuth token response, part of the response body (up to 256 characters) is reflected back in a 502 error message. This vulnerability circumvents SSRF protections that are only applied to the gateway.url field, not to OAuth configuration parameters.

An authenticated user with gateway creation privileges can perform SSRF attacks to access internal network resources and cloud metadata endpoints. This could lead to unauthorized information disclosure from internal services or cloud metadata APIs. The reflection of response data in error messages may aid attackers in reconnaissance. However, there is no indication of remote code execution or privilege escalation beyond the authenticated user's existing privileges.

A patch is available for this vulnerability. Since this is a cloud-hosted service, IBM manages remediation for the ContextForge MCP Gateway. Users should apply the official fix provided by IBM as soon as possible. Until patched, restrict gateway creation privileges to trusted users only. Monitor vendor advisories for updates and confirm patch deployment.