CVE-2026-53708: ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

August 14, 2026

The /admin/gateways/test endpoint validates submitted URLs by resolving the hostname at validation time and blocking private address ranges. The HTTP client independently re-resolves DNS at connection time with no IP binding between the two operations, creating a TOCTOU window exploitable via DNS rebinding. The source code explicitly acknowledges this limitation in two separate locations.

References

github.com/IBM/mcp-context-forge/releases/tag/v1.0.3
github.com/IBM/mcp-context-forge/security/advisories/GHSA-9hgc-g3w5-67cm
github.com/advisories/GHSA-9hgc-g3w5-67cm
nvd.nist.gov/vuln/detail/CVE-2026-53708

Code Behaviors & Features

Detect and mitigate CVE-2026-53708 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →