The /admin/gateways/test endpoint in mcp-contextforge-gateway performs hostname validation by resolving DNS and blocking private IP ranges at validation time. However, the HTTP client (httpx via ResilientHttpClient) independently re-resolves DNS at connection time without binding to the validated IP address, creating a TOCTOU window exploitable via DNS rebinding. This allows an attacker controlling DNS to present a public IP during validation and a private IP during connection, bypassing SSRF protections. The vulnerability requires MCPGATEWAY_ADMIN_API_ENABLED=true and a credential with gateways.read permission. The maintainers explicitly acknowledge this limitation in the source code and track it as an open defect (ICACF-15).

An attacker with valid credentials holding gateways.read permission and with the admin API enabled can exploit the DNS TOCTOU race condition to bypass SSRF protections. This may allow the attacker to cause the system to connect to internal or private IP addresses that should be blocked, potentially exposing internal services or sensitive data. The vulnerability does not allow privilege escalation or denial of service directly but compromises the SSRF protection mechanism.

A patch is available for this vulnerability. Operators should upgrade to a fixed version to eliminate the DNS TOCTOU race condition. Until patched, mitigation requires ensuring MCPGATEWAY_ADMIN_API_ENABLED is not enabled unless necessary and strictly controlling credentials with gateways.read permission. The vendor acknowledges the limitation and tracks it for future improvement; thus, applying the official fix is recommended. No temporary workaround is described in the advisory.