CVE-2026-53708
Received Received - Intake

SSRF Bypass via DNS Rebinding in ContextForge

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validate_gateway_test_url() in mcpgateway/common/validators.py to resolve and reject private, loopback, link-local, and cloud-metadata addresses, but ResilientHttpClient later resolves the original hostname again without binding the validated address. When MCPGATEWAY_ADMIN_API_ENABLED is enabled, an attacker with a database-backed role containing explicit gateways.read permission can use DNS rebinding to return a public address during validation and a private or metadata address during connection, bypassing ssrf_blocked_networks and ssrf_dns_fail_closed because those controls apply only to the validation-time result. The endpoint's allow_admin_bypass=False setting means a bootstrap-only virtual platform-admin identity without a database role is not sufficient. Successful exploitation can reach internal services and cloud metadata, expose cloud credentials, access internal APIs, or probe internal network ports. This issue is fixed in version 1.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-53708
EUVD
EUVD-2026-77591

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
contextforge contextforge 1.0.3
ibm mcp_context_forge 1.0.3
ibm mcp_context_forge to 1.0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-350 The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-53708 is a Server-Side Request Forgery (SSRF) vulnerability in ContextForge, an AI gateway and proxy. It allows attackers with specific permissions to bypass SSRF protections using DNS rebinding. The issue occurs because the system validates URLs by resolving hostnames but later reconnects without binding the validated IP address. This creates a gap where an attacker can switch a hostname from a public IP (during validation) to a private IP (during connection), bypassing protections against accessing internal services or cloud metadata.

The vulnerability requires the MCPGATEWAY_ADMIN_API_ENABLED flag to be true and the attacker to have a role with gateways.read permission. Successful exploitation can expose internal APIs, cloud credentials, or enable port scanning.

Detection Guidance

Detecting this vulnerability requires checking for DNS rebinding attempts targeting the /admin/gateways/test endpoint. Monitor logs for repeated DNS resolution changes for the same hostname within short timeframes. Check for connections to private or cloud metadata IPs from the MCP Context Forge service. Verify if MCPGATEWAY_ADMIN_API_ENABLED is set to true and if any users have gateways.read permissions.

Impact Analysis

This vulnerability allows attackers to bypass SSRF protections and access internal services, cloud metadata, or APIs that should be restricted. It can lead to unauthorized access to sensitive data, exposure of cloud credentials, internal network probing, or port scanning. Attackers could also compromise cloud accounts if IMDSv1 is enabled.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance. Exposure of cloud credentials or internal APIs may result in data breaches, triggering regulatory penalties. The fix in version 1.0.3 includes PII redaction in logs and FIPS compliance mode, which helps meet privacy and security standards.

Mitigation Strategies
  • Upgrade to ContextForge version 1.0.3 or later to address the DNS rebinding vulnerability.
  • Disable MCPGATEWAY_ADMIN_API_ENABLED if not required for operations.
  • Review and restrict gateways.read permissions to only necessary users.
  • Implement network-level SSRF protections to block outbound connections to private or metadata IP ranges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53708. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart