Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ibm/mcp-context-forge

              main @ 30a7057
            

219

Fixes

CVEs

CRITICAL

Peak severity

27.3%

Coverage

Highlights

Auth Bypass: 95 prior fixes. Scrutinize any change in this area.

mcpgateway/admin.py: most-fixed (22 issues). Treat as high-risk during review.

120 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The Layer 2 RBAC implementation historically suffered from cross-team leakage and authorization bypasses. Specifically, auto-assigned personal team roles were improperly aggregated into global permissions, and token team-narrowing restrictions were not consistently enforced across check paths, allowing scoped tokens to perform administrative actions.

SSRF: Gateway validation endpoints and outbound HTTP testers historically allowed arbitrary network requests due to weak redirect handling, trailing-dot FQDN bypasses, and a lack of DNS-IP pinning, which enabled attackers to reach sensitive local resources.

Code Injection: The LLM Guard plugin utilized an unsafe Python eval() call to evaluate policy conditions, enabling remote execution of arbitrary system commands prior to being replaced with a safe AST-based evaluator.