Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-53709— MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery

Quick assessment

Affected
IBM mcp-context-forge
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MCP Context Forge 是一个 MCP 网关和管理平台。在版本 1.0.2 之前， 和 文件中包含一个已知的 JWT 密钥（ ）。同时， 函数接受使用该密钥签名的 HS256 算法 JWT 令牌，而 函数在令牌主题（subject）匹配 且 为 false 时，会直接创建平台管理员身份。 因此，远程未认证攻击者可以在没有数据库账户的情况下，生成被系统接受的、具有管理员权限的令牌。只要易受攻击的签名密钥仍然配置且平台管理员引导功能（platform-admin bootstrap）仍处于启用状态，伪造的访

CVSS 9.8 · Critical EPSS 0.45% · P38

Affected Version Matrix 1

VendorProduct Version RangeStatus
IBM mcp-context-forge < 1.0.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53709

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery
Source: CVE Program / CVE List V5
Vulnerability Description
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption. This issue is fixed in version 1.0.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
IBM mcp-context-forge < 1.0.2 -

II. Public POCs for CVE-2026-53709

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53709

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-53709 (1)

Vendor Pages for CVE-2026-53709 (1)

Same Patch Batch · IBM · 2026-10-13 · 18 CVEs total

CVE-2026-93909 9.1 CRITICAL IBM WebSphere Application Server Liberty is affected by an authentication bypass
CVE-2026-93895 9.1 CRITICAL IBM WebSphere Application Server Liberty Improper Access Control
CVE-2026-101294 8.7 HIGH IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by
CVE-2026-93905 8.2 HIGH IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted dat
CVE-2026-105443 8.2 HIGH IBM WebSphere Application Server Liberty is affected by an improper access control
CVE-2026-93907 8.1 HIGH IBM WebSphere Application Server is affected by a bypass authentication vulnerability
CVE-2026-95680 8.0 HIGH IBM WebSphere Application Server is affected by an authorization bypass
CVE-2026-103499 7.5 HIGH IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by
CVE-2026-105442 7.5 HIGH IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by
CVE-2026-95695 7.4 HIGH IBM WebSphere Application Server Liberty Incorrect Authorization
CVE-2026-14909 6.5 MEDIUM IBM WebSphere Application Server Liberty Information Disclosure
CVE-2026-77816 6.5 MEDIUM IBM WebSphere Application Server Liberty Improper Certificate Validation
CVE-2026-95696 6.5 MEDIUM IBM WebSphere Application Server Liberty Denial of Service
CVE-2026-79715 5.5 MEDIUM IBM WebSphere Application Server Liberty Path Traversal
CVE-2026-11713 5.4 MEDIUM IBM WebSphere Application Server Liberty Incorrect Authorization
CVE-2026-53711 5.1 MEDIUM MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI
CVE-2026-14532 4.3 MEDIUM IBM WebSphere Application Server Liberty Integer Overflow

IV. Related Vulnerabilities

Same product: mcp-context-forge
Same vendor: IBM
Same weakness: CWE-287

V. Comments for CVE-2026-53709

No comments yet

Leave a comment