ContextForge: cross-tenant overwrite of public tools and credentials (CVE-2026-110178)

A ContextForge user with team-scoped import permission can overwrite public tools, resources, and prompts owned by other tenants. Changes to endpoints or credentials can redirect later gateway calls to an attacker-controlled host.

Public CVE record · Vendor or publisher advisory · Module source · Source and API bundle

Result. The marked request reached the synthetic backend in the baseline. Both protected configurations returned HTTP 403 for that request and the backend counter did not change. The native module passed the benign probe.

The vulnerability

The affected versions and upgrade guidance are listed above. The Eden policy and module were tested against the HTTP fixture described below.

The Eden patch

Tier 1 — declarative policy. The recorded policy denies every method on the recorded fixture route and its descendants. This is a coarse rule: it also blocked the benign probe on the same route, which is the recorded false positive.

{
  "version": 1,
  "profile": "http-structure-v1",
  "policy": {
    "version": 1,
    "rules": [
      {
        "scope": {
          "methods": [],
          "path": "/tools",
          "descendants": true
        },
        "require": {
          "kind": "deny"
        }
      }
    ]
  }
}

Tier 2 — native Rust module. The rule refuses POST and PUT requests on the synthetic /tools route with endpoint or credentials markers when the fixture's x-cfx-tenant header is absent.

const ROUTE: &[u8] = b"/tools";

Implement the remediation

The commands are operator examples for the recorded scope. Compare fixture routes and software selectors with the intended deployment before use. See deployment prerequisites and the API example.

1. Prepare the target. Verify the loaded IBM ContextForge MCP Gateway version against the advisory. Use a compatible Eden HTTP interlay and an authenticated operator with Configure permission. Use the recorded declaration and the linked source.
2. Apply the declaratory policy. Set INTERLAY to the target interlay UUID in the authenticated Eden CLI. Save the interlay's complete current settings, place the policy from this report in settings.remediation, and PATCH the full settings object with a fresh Idempotency-Key. Read the interlay back and confirm remediation_status.state is ready.
3. Import and activate the native module. Build the schema-2 archive from the linked source with the compatible SDK, verify its digest, and PUT it to the interlay's patch-packages endpoint. Import requires explicit activation: enroll the publisher key, attest the host inventory, inspect the returned configuration, obtain independent host approval, sign the typed statement, admit, and activate. Read the receipt until serving_now is true and the expected shards are acknowledged. Full command sequences are in the API example.
4. Verify, revoke, and restore. Replay the benign and advisory-shaped probes and compare the backend counter. Revoke the operation and confirm the marked fixture request no longer succeeds (fail-closed 503); re-approve, re-admit, and reactivate a replacement operation to restore protection.

Vendor update. Follow the update instructions for the installed product and release line. Vendor or publisher advisory

Fixture and probes

The ordinary tool update carried the fixture tenant header. The marked write supplied endpoint and credential fields without that header. The fixture counted delivery to its tool update handler.

Measured comparison (2026-11-13 UTC)

The values after each status are the observed increases in the fixture's effect counter.

Signed module authority

Import returned HTTP 201 with explicit activation required and signature verification deferred. Read-only inspection was refused (403) for the reader principal, admission of a tampered statement was rejected (400), and admission of an invalid signature was refused (403). The activation receipt reported the module serving on all 32 expected shards. After revocation the marked fixture probe received HTTP 503 (fail-closed); re-approval and reactivation restored the refusal (403, counter unchanged).

• Source SHA-256 794710eb53b0f0e4d4ea9a3b1565411c8fb52d767d8bf9c3250bedf6bb738f37
• Tested binary SHA-256 cfc4848790853034314b14707e1329ba52679eff25b9fdcfa928016ecd3cec57
• Activation operation 9f26945c-d183-4d0c-83d6-d8caee94e030

Performance

Instrument: client wall-clock through the interlay (includes the network hop), warmup discarded, mean/p50/p95 in milliseconds.

Test scope

The module checks POST and PUT requests on a representative /tools route for endpoint or credentials markers and the presence of a synthetic tenant header. IBM identifies POST /v1/import as the affected path. The fixture did not exercise bulk import, verify header values, or test tenant authorization. A caller-supplied header can pass the rule.

Evidence and artifacts

• Public CVE record
• Published module source