CVE-2026-110278

Gateway identity claims could be replayed or sent to the wrong MCP server

IBM · ContextForge MCP Gateway identity propagation

First documented disclosure · Review checkpoint

Summary

Identity signatures used a static payload and tool invocation omitted per-gateway propagation checks. A third-party MCP server could receive sensitive user identity data or accept a replayed claim.

Severity and exploitation evidence

High · 7.4/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Identity signatures used a static payload and tool invocation omitted per-gateway propagation checks.

Conditions required

Identity propagation was in use and a signed claim could be replayed or forwarded to an upstream server.

Potential impact

A third-party MCP server could receive sensitive user identity data or accept a replayed claim.

Affected versions and configurations

1.0.0 through 1.1.0.

Fix and mitigation status

1.1.1.

Practical next steps

Upgrade, or disable identity propagation globally and limit gateway access until updated.

Operating lesson

Bind each signed user claim to its intended gateway and invocation.

Evidence and limits

The public fix discussion described this issue on 2026-10-23. The formal advisory followed on 2026-11-12, and the CVE record on 2026-11-13.

Sources