Plango
Get Plango

For developers

Mac security

← AI agent vulnerabilities

CVE-2026-77822

ContextForge

8.2
Severity
High
Published
September 4, 2026
Last modified
September 15, 2026

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.

CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness

References

CVE-2026-77822 on NVD

Listed in

HighMCP serversServer-side request forgery

Related CVEs

Oct 21
CVE-2026-1141237.5

The officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service…

 Oct 21
CVE-2026-1140907.1

Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints.

 Oct 20
CVE-2026-83555.4

IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST…

 Oct 20
CVE-2026-1137313.3

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.

 Oct 20
CVE-2026-1133785.3

A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0.

 Oct 20
CVE-2026-1117678.6

The experimental tasks feature (taskStore) did not check which session created a task.