{"affected":[{"product":"ContextForge MCP Gateway","source":"CNA: ibm","vendor":"IBM","versions":[{"lessThanOrEqual":"1.0.11","status":"affected","version":"1.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-18484","cwes":["CWE-706"],"description":"IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow a remote authenticated attacker to cause a denial of service due to improper slug normalization causing tool name collisions.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: ibm","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794160499348,"publishedAt":1794160499348,"references":[{"source":"CNA: ibm","tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7294233"}],"remediation":[{"kind":"fix","source":"CNA: ibm","text":"IBM strongly recommends addressing the vulnerability now.\n\nProduct(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM ContextForge MCP Gateway\n\n\n\n1.0.0 - v1.0.11Upgrade to v1.1.0. See [ v1.1.0 release notes https://github.com/IBM/mcp-context-forge/releases/tag/v1.1.0 ]"},{"kind":"workaround","source":"CNA: ibm","text":"If an immediate upgrade is not possible, an administrator can mitigate an active collision by renaming or removing one of the two conflicting gateway registrations, which restores invocability of the affected tool. There is no configuration setting that prevents the collision from being created prior to the v1.1.0 fix.\n\n\nIBM strongly recommends upgrading to v1.1.0."},{"kind":"fix","source":"CNA: ibm","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.ibm.com/support/pages/node/7294233"}],"revision":"9fc44500448b82dff3cabfc749082110308848ec93619ccc9f3edd7cb675856b","sources":[{"modifiedAt":1794160499348,"name":"CNA: ibm","retrievedAt":1794161342672,"url":"https://www.cve.org/CVERecord?id=CVE-2026-18484"}],"ssvc":null,"status":"published","title":"IBM ContextForge MCP Gateway is affected by a denial-of-service via tool name collision through slug normalization","updatedAt":1794161342672}