All 4 CVE vulnerabilities found in mcp-context-forge, with AI-generated Chinese analysis, references, and POCs.
Vendor: IBM
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-53711 | MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI CWE-79 | 5.1 | Medium | 2026-10-13 |
| CVE-2026-53709 | MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery CWE-287 | 9.8 | Critical | 2026-10-13 |
| CVE-2026-53710 | MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server CWE-94 | 10.0 | Critical | 2026-09-15 |
| CVE-2026-53708 | ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`) CWE-350 | 6.6 | Medium | 2026-09-14 |
All 4 known CVE vulnerabilities affecting mcp-context-forge with full Chinese analysis, references, and POCs where available.