ContextForge: server-side request forgery via tool fields (CVE-2026-110194)

An authenticated ContextForge user can induce the gateway to send unauthorized requests. Those requests can expose information about otherwise unreachable network services or enable further attacks.

Public CVE record · Vendor or publisher advisory · Module source · Source and API bundle

Result. The marked request reached the synthetic backend in the baseline. Both protected configurations returned HTTP 403 for that request and the backend counter did not change. The native module passed the benign probe.

The vulnerability

The affected versions and upgrade guidance are listed above. The Eden policy and module were tested against the HTTP fixture described below.

The Eden patch

Tier 1 — declarative policy. The recorded policy denies every method on the recorded fixture route and its descendants. This is a coarse rule: it also blocked the benign probe on the same route, which is the recorded false positive.

{
  "version": 1,
  "profile": "http-structure-v1",
  "policy": {
    "version": 1,
    "rules": [
      {
        "scope": {
          "methods": [],
          "path": "/tools",
          "descendants": true
        },
        "require": {
          "kind": "deny"
        }
      }
    ]
  }
}

Tier 2 — native Rust module. The rule checks the synthetic /tools route for url or endpoint text in the body and a selected URL scheme marker in the target or body.

const ROUTE: &[u8] = b"/tools";
static SCHEMES: [&[u8]; 3] = [b"://", b"%3a%2f%2f", b"%3a//"];

Implement the remediation

The commands are operator examples for the recorded scope. Compare fixture routes and software selectors with the intended deployment before use. See deployment prerequisites and the API example.

1. Prepare the target. Verify the loaded IBM ContextForge MCP Gateway version against the advisory. Use a compatible Eden HTTP interlay and an authenticated operator with Configure permission. Use the recorded declaration and the linked source.
2. Apply the declaratory policy. Set INTERLAY to the target interlay UUID in the authenticated Eden CLI. Save the interlay's complete current settings, place the policy from this report in settings.remediation, and PATCH the full settings object with a fresh Idempotency-Key. Read the interlay back and confirm remediation_status.state is ready.
3. Import and activate the native module. Build the schema-2 archive from the linked source with the compatible SDK, verify its digest, and PUT it to the interlay's patch-packages endpoint. Import requires explicit activation: enroll the publisher key, attest the host inventory, inspect the returned configuration, obtain independent host approval, sign the typed statement, admit, and activate. Read the receipt until serving_now is true and the expected shards are acknowledged. Full command sequences are in the API example.
4. Verify, revoke, and restore. Replay the benign and advisory-shaped probes and compare the backend counter. Revoke the operation and confirm the marked fixture request no longer succeeds (fail-closed 503); re-approve, re-admit, and reactivate a replacement operation to restore protection.

Vendor update. Follow the update instructions for the installed product and release line. Vendor or publisher advisory

Fixture and probes

The ordinary probe used a scheme-free tool reference. The marked probe placed a scheme-bearing address in a tool URL field. The fixture counted delivery of the marked destination.

Measured comparison (2026-11-13 UTC)

The values after each status are the observed increases in the fixture's effect counter.

Signed module authority

Import returned HTTP 201 with explicit activation required and signature verification deferred. Read-only inspection was refused (403) for the reader principal, admission of a tampered statement was rejected (400), and admission of an invalid signature was refused (403). The activation receipt reported the module serving on all 32 expected shards. After revocation the marked fixture probe received HTTP 503 (fail-closed); re-approval and reactivation restored the refusal (403, counter unchanged).

• Source SHA-256 5733c32c6ab0b5dbc2fa555851f73b97f420891fecf3e68cd7b74edaf4a2ae74
• Tested binary SHA-256 45ea9b7cbac14b66ce8ca88d06ec1e1c74e14a6c8f5e901335ef6ffacd47295c
• Activation operation 4cb7e22d-e24f-4be3-b39d-01db807922d4

Performance

Instrument: client wall-clock through the interlay (includes the network hop), warmup discarded, mean/p50/p95 in milliseconds.

Test scope

The module checks a representative /tools route for url or endpoint markers in the body and selected URL scheme markers in the body or target. The test measured a fixture counter. It did not resolve destinations, follow redirects, or send an outbound request.

Evidence and artifacts

• Public CVE record
• Published module source