ContextForge: X-Upstream-Authorization header replaces managed credentials (CVE-2026-110279)

A ContextForge user can replace a gateway-managed upstream credential with a caller-supplied credential. This can bypass per-user permissions and misattribute upstream requests in audit records.

Public CVE record · Vendor or publisher advisory · Module source · Source and API bundle

Result. The marked request reached the synthetic backend in the baseline. Both protected configurations returned HTTP 403 for that request and the backend counter did not change. The native module passed the benign probe.

The vulnerability

The affected versions and upgrade guidance are listed above. The Eden policy and module were tested against the HTTP fixture described below.

The Eden patch

Tier 1 — declarative policy. The recorded policy denies every method on the recorded fixture route and its descendants. This is a coarse rule: it also blocked the benign probe on the same route, which is the recorded false positive.

{
  "version": 1,
  "profile": "http-structure-v1",
  "policy": {
    "version": 1,
    "rules": [
      {
        "scope": {
          "methods": [],
          "path": "/tools/call",
          "descendants": true
        },
        "require": {
          "kind": "deny"
        }
      }
    ]
  }
}

Tier 2 — native Rust module. The rule refuses requests presenting an X-Upstream-Authorization header. It checks the header name case-insensitively.

//! refuse client-supplied X-Upstream-Authorization headers.

Implement the remediation

The commands are operator examples for the recorded scope. Compare fixture routes and software selectors with the intended deployment before use. See deployment prerequisites and the API example.

1. Prepare the target. Verify the loaded IBM ContextForge MCP Gateway version against the advisory. Use a compatible Eden HTTP interlay and an authenticated operator with Configure permission. Use the recorded declaration and the linked source.
2. Apply the declaratory policy. Set INTERLAY to the target interlay UUID in the authenticated Eden CLI. Save the interlay's complete current settings, place the policy from this report in settings.remediation, and PATCH the full settings object with a fresh Idempotency-Key. Read the interlay back and confirm remediation_status.state is ready.
3. Import and activate the native module. Build the schema-2 archive from the linked source with the compatible SDK, verify its digest, and PUT it to the interlay's patch-packages endpoint. Import requires explicit activation: enroll the publisher key, attest the host inventory, inspect the returned configuration, obtain independent host approval, sign the typed statement, admit, and activate. Read the receipt until serving_now is true and the expected shards are acknowledged. Full command sequences are in the API example.
4. Verify, revoke, and restore. Replay the benign and advisory-shaped probes and compare the backend counter. Revoke the operation and confirm the marked fixture request no longer succeeds (fail-closed 503); re-approve, re-admit, and reactivate a replacement operation to restore protection.

Vendor update. Follow the update instructions for the installed product and release line. Vendor or publisher advisory

Fixture and probes

The ordinary probe called a tool without the override header. The marked probe added X-Upstream-Authorization to the same call. The fixture counted delivery of the override header.

Measured comparison (2026-11-13 UTC)

The values after each status are the observed increases in the fixture's effect counter.

Signed module authority

Import returned HTTP 201 with explicit activation required and signature verification deferred. Read-only inspection was refused (403) for the reader principal, admission of a tampered statement was rejected (400), and admission of an invalid signature was refused (403). The activation receipt reported the module serving on all 32 expected shards. After revocation the marked fixture probe received HTTP 503 (fail-closed); re-approval and reactivation restored the refusal (403, counter unchanged).

• Source SHA-256 df294687805fe0bdaffe424bd73c88184a7d450a295cfd00679e3364d78ad950
• Tested binary SHA-256 ed70daf900a341a90c30f7f79bed91c27e595d0283cd35d177bab5a45866d8b6
• Activation operation b16865a0-4f2e-4fa4-8bf4-90da4a73f78e

Performance

Instrument: client wall-clock through the interlay (includes the network hop), warmup discarded, mean/p50/p95 in milliseconds.

Test scope

The module refuses the named header across the fixture's routes. The test measured delivery to a synthetic handler. It did not exercise ContextForge's credential selection, upstream authentication, or audit attribution.

Evidence and artifacts

• Public CVE record
• Published module source