Threats affecting pkg:maven/com.ibm/contextforge-mcp-gateway

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain an improper access control vulnerability in the bulk import functionality. A remote authenticated attacker with team-scoped admin.import permission can manipulate the endpoint URL, request headers, and authentication credentials of public tools, resources, and prompts owned by other tenants. This is achieved by sending a crafted POST request to the /v1/import endpoint with conflict_strategy=update, causing subsequent AI gateway calls to be redirected to an attacker-controlled host.

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain a cross-site scripting (XSS) vulnerability. This flaw allows a privileged user to inject arbitrary JavaScript code into the web interface, potentially altering its intended functionality and leading to the disclosure of credentials within a trusted session.

IBM ContextForge MCP Gateway versions 1.0.0 through 1.1.0 contain an improper authentication vulnerability. The X-Upstream-Authorization HTTP header can override the gateway-managed upstream credentials for OAuth, bearer, and basic authentication methods. This flaw allows an authenticated user to make upstream requests using different credentials, potentially bypassing per-user permissions and audit attribution controls.

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain an improper authentication vulnerability. This flaw allows an authenticated user to bypass upstream credential-level authorization policies by exploiting an insufficiently specific cache key in the RFC 8693 token exchange cache. As a result, cached upstream bearer tokens can be reused across different credentials belonging to the same user, potentially leading to unauthorized access.

IBM ContextForge MCP Gateway versions 1.0.0 through 1.1.0 contain an authentication bypass vulnerability due to replay of identity propagation claims signatures. This occurs because of static signature payloads and missing per-gateway configuration checks during tool invocation, potentially exposing sensitive user identity information to third-party MCP servers.

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain a vulnerability where improper slug normalization can cause tool name collisions. This flaw allows a remote authenticated attacker to trigger a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability.