IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.
Operators who cannot immediately upgrade can reduce exposure by:
-
Disable A2A — set the environment variable MCPGATEWAY_A2A_ENABLED=False to disable the A2A subsystem entirely. This removes the vulnerable endpoint from the attack surface at the cost of A2A functionality.
-
Restrict A2A create/invoke permissions — revoke A2A creation and invocation rights from developer and team_admin roles in environments where A2A is not required.
-
Network-level egress controls — enforce outbound network policy at the host or cloud level to block the gateway process from reaching cloud metadata endpoints and private RFC 1918 address ranges, preventing exploitation of the DNS-rebinding window even if a rebind attempt succeeds.
None of these mitigations eliminate the underlying vulnerability; IBM strongly recommends upgrading to the fixed version.
IBM strongly recommends addressing the vulnerability now.
Product(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM ContextForge MCP Gateway<= v1.0.8Upgrade to v1.0.9
https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.9
Note: <Component A / B names> are bundled with <Product profile name> to provide <feature / function description>