CVE-2026-11918

ContextForge could fail to enforce content policy on structured tool arguments

IBM · ContextForge MCP Gateway content filters

First documented disclosure · Review checkpoint

Summary

Configured redaction and content filters could overlook values inside normal structured tool calls.

Severity and exploitation evidence

Medium · 5.4/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources describe the vulnerability and its conditions. They do not identify malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Two filtering plugins did not evaluate all of the structured data in a tool call.

Conditions required

An authenticated MCP client can send structured tool arguments through installations using the affected plugins.

Potential impact

Secrets, personal information or prohibited content could pass a filter the operator relied on.

Affected versions and configurations

Through 1.0.4.

Fix and mitigation status

1.0.5.

Practical next steps

Upgrade to 1.0.5 or later. IBM reports that keeping the affected plugins active offers no complete workaround.

Operating lesson

Apply policy recursively to nested tool arguments.

Evidence and limits

IBM’s original notice describes the filter behavior. It documents no customer disclosure.

Sources