CVE-2026-110279

An incoming header could override an MCP gateway’s upstream identity

IBM · ContextForge MCP Gateway upstream credentials

First documented disclosure · Review checkpoint

Summary

The gateway accepted a caller-supplied upstream credential in place of its managed credential. A request could run under a different upstream identity, bypassing per-user permissions or misleading the audit trail.

Severity and exploitation evidence

High · 8.1/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The gateway accepted a caller-supplied upstream credential in place of its managed credential.

Conditions required

An authenticated caller could reach a gateway using OAuth, bearer or basic upstream authentication.

Potential impact

A request could run under a different upstream identity, bypassing per-user permissions or misleading the audit trail.

Affected versions and configurations

1.0.0 through 1.1.0.

Fix and mitigation status

IBM directs customers to deploy 1.1.1.

Practical next steps

Upgrade to 1.1.1. Until then, strip the upstream-authorization header at the proxy and restrict access.

Operating lesson

Give the gateway sole authority to choose credentials it forwards.

Evidence and limits

One cell in the IBM remediation table says 2.0. Its explicit deployment instruction and linked release both say 1.1.1. The public fix discussion described this issue on 2026-10-27. The formal advisory followed on 2026-11-12, and the CVE record on 2026-11-13.

Sources