IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters.
None. IBM strongly recommends upgrading to the fixed version and rotating server credentials.
IBM strongly recommends addressing the vulnerability now.
Product(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM ContextForge MCP Gateway<=v1.0.7Upgrade to v1.0.8. See release notes https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.8%29 . Rotate JWT_SECRET_KEY, AUTH_ENCRYPTION_SECRET, DATABASE_URL, REDIS_URL, and BASIC_AUTH_PASSWORD on any deployment running prior versions.
Note: From version v1.0.8 on a more complex AUTH_ENCRYPTION_SECRET is required:
Action required before upgrading: run the one-shot re-encryption script (mcpgateway/scripts/migrate_enc_secret.py) with the old and new keys while the gateway is stopped. See the full rotation guide at docs/docs/operations/auth-encryption-secret-rotation.md https://github.com/IBM/mcp-context-forge/blob/v1.0.8/docs/docs/operations/auth-encryption-secret-rotation.md for step-by-step instructions, deployment-specific commands, and special cases (Helm/Kubernetes, Python package consumers, rollback).