cyfenced.com →

[ CVE-2026-77825 · Published 24 Sep 2026 ]

Vulnerability in IBM ContextForge MCP Gateway

CVSS 4.9 EPSS <1%Fix available

[ Description ]Official description

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint (`GET /v1/admin/logs/file`). The path confinement check uses `str.startswith()` rather than proper boundary validation, allowing an authenticated admin to read `.log`, `.jsonl`, and `.json` files outside the configured `LOG_FOLDER` by supplying a filename that resolves into a sibling directory whose absolute path shares the log directory's string prefix.

[ Fixes ]Fixes and patches

  • Patch on ibm.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References