CVE Alert: CVE-2026-110279 – IBM

IBM ContextForge MCP Gateway 1.0.0 through 1.1.0 is vulnerable to improper credential handling because the X-Upstream-Authorization request header can override the gateway-managed upstream credential for OAuth (authorization_code and client_credentials), bearer and basic authenticated gateways, which could allow an authenticated user to cause upstream requests to be made with a different credential and bypass per-user permission and audit attribution.

**Risk verdict:** Prioritise prompt remediation: a network-reachable, authenticated user could misuse the gateway’s upstream identity, but no KEV, SSVC exploitation, PoC or EPSS data is supplied to establish active exploitation or a priority-one rating.

**Why this matters:** Misuse could let a user exercise upstream permissions beyond their intended identity, weakening authorisation boundaries and audit attribution. Attackers may seek sensitive data or perform unauthorised actions through connected services; impact depends on the upstream credentials and tools available.

**Most likely attack path:** A remote attacker needs a valid account with low-level access, but no further user action is required. They can manipulate a request to the gateway; Scope is unchanged, though actions taken through connected upstream services could broaden practical business impact.

**Who is most exposed:** Internet- or broadly network-accessible deployments are most exposed, particularly gateways connected to privileged APIs, enterprise data stores or tool integrations.

Alert on requests containing `X-Upstream-Authorization` at the gateway or fronting proxy.

Compare upstream identity used with the identity expected for the initiating user.

Review audit records for unexpected access, actions or attribution gaps.

Investigate unusual upstream activity following requests from low-privilege accounts.

Mitigation and prioritisation

Upgrade promptly to the vendor-fixed release; validate gateway and integration behaviour after deployment.

Until upgraded, strip the named header at the reverse proxy for all MCP endpoints.

Restrict endpoint access to trusted networks and review exposed routes.

Audit upstream credentials, permissions and recent activity; rotate credentials if misuse is suspected.

Confirm KEV, SSVC, PoC and EPSS status before final prioritisation; their absence here leaves exploitation likelihood uncertain.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.