CVE-2026-53710
Received Received - Intake

Command Injection in MCP Context Forge Python Sandbox Server

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr through safe_builtins, omits a required _getattr_ guard, and relies on validate_code checks for literal dangerous dunder strings. An attacker can construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands with the server process privileges through the execute_code MCP tool. The HTTP/SSE transport can expose this tool without authentication, while stdio-only deployments have reduced network reachability. The issue affects the python_sandbox_server subproject and does not directly affect the core Context Forge gateway or proxy components. This issue is fixed in version 1.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-53710
EUVD
EUVD-2026-78933

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mcp python_sandbox_server 1.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-53710 is a critical sandbox escape vulnerability in the python_sandbox_server component of IBM's mcp-context-forge project. It allows arbitrary OS command execution through weaknesses in the RestrictedPython sandbox implementation. The vulnerability stems from exposure of raw getattr/setattr functions, missing _getattr_ guards, incorrect builtins merge order, and weak dunder string detection in validate_code.

Detection Guidance

Check if the python_sandbox_server component is running versions prior to 1.0.2. Inspect the server logs for unusual execute_code tool usage or OS command execution attempts. Monitor network traffic for unauthorized HTTP/SSE requests to the sandbox endpoint.

Impact Analysis

An attacker with access to the HTTP endpoint can exploit this to execute operating system commands with the server's privileges. This could lead to filesystem compromise, network pivoting in containerized environments, or complete system takeover depending on deployment context.

Mitigation Strategies

Upgrade to version 1.0.2 or later of mcp-context-forge. Remove raw getattr/setattr from safe_builtins and replace with _guarded_getattr/_guarded_setattr. Add authentication for HTTP tool calls via SANDBOX_API_TOKEN. Implement stricter policy controls and validate code using AST-based analysis instead of substring matching.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53710. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart