# CVE-2026-110195: IBM ContextForge MCP Gateway is affected by an authorization bypass vulnerability

Status: published. Published: 2026-11-13. Updated: 2026-11-13.

IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow an authenticated caller to bypass upstream credential-level authorization policies due to an insufficiently specific cache key in the RFC 8693 token exchange cache, enabling reuse of cached upstream bearer tokens across different credentials belonging to the same user.

## Remediation

- fix: IBM strongly recommends addressing the vulnerability now.

Product(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM ContextForge MCP Gatewayv1.1.0Install or upgrade to v1.1.0 [ v1.1.0 Release Notes https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.0 ] (source: CNA: ibm)
- workaround: IBM strongly recommends upgrading to the fixed version.

If this cannot be done, ensure authorization policies for upstream MCP servers assign identical scopes and permissions to all credential types (interactive session JWTs and API tokens) for a given account, or avoid configuring OAuth token exchange with `subject_token_source=inbound_user_jwt` across mixed credential types until the gateway is updated. (source: CNA: ibm)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: ibm) — https://www.ibm.com/support/pages/node/7296695

## Affected products and versions

- IBM / ContextForge MCP Gateway: ≥ 1.0.0; ≤ 1.0.11 (affected, semver). Source: CNA: ibm

## Severity and prioritization

- CVSS 3.1: 5.4 (medium); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N; source: CNA: ibm

- CVSS 3.1: 5.4 (medium); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N; source: NVD: psirt@us.ibm.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-287

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.ibm.com/support/pages/node/7296695 (CNA: ibm; vendor-advisory, patch)

- https://www.ibm.com/support/pages/node/7296695 (psirt@us.ibm.com)

## Provenance

- CNA: ibm: https://www.cve.org/CVERecord?id=CVE-2026-110195; retrieved 2026-11-13; source updated 2026-11-13

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110195; retrieved 2026-11-14; source updated 2026-11-13

Revision: 32ef2932b591559009d639b604816ddb8530ed30cea723ff23219cfa8a6897bc

Canonical: https://y2.dev/cve/CVE-2026-110195

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.