CVE-2026-18489
CVE-2026-18489 is a high-severity vulnerability in Ibm Contextforge with a CVSS 3.x base score of 7.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-488.
Key facts
- Severity: High (CVSS 3.x base score 7.4)
- EPSS exploit prediction: 0% (18th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-488
- Affected product: Ibm Contextforge
- Published:
- Last modified:
Description
IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.
Frequently asked questions
- What is CVE-2026-18489?
- IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.
- How severe is CVE-2026-18489?
- CVE-2026-18489 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
- Is CVE-2026-18489 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (18th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-18489?
- CVE-2026-18489 affects Ibm Contextforge. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-18489?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-18489 published?
- CVE-2026-18489 was published on 2026-09-04 and last updated on 2026-09-15.
References
Affected products (1)
- cpe:2.3:a:ibm:contextforge:*:*:*:*:*:python:*:*
More vulnerabilities in Ibm Contextforge
- CVE-2026-78573 — Critical (CVSS 9.8): IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the…
- CVE-2026-18486 — High (CVSS 8.8): IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain…
- CVE-2026-77822 — High (CVSS 8.2): IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to…
- CVE-2026-18905 — High (CVSS 7.7): IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context Forge could allow a remote…
All CVEs affecting Ibm Contextforge →
Other CWE-488 vulnerabilities
- CVE-2026-16326 — Critical (CVSS 10.0): In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may…
- CVE-2026-16498 — Critical (CVSS 10.0): The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the…
- CVE-2026-19931 — Critical (CVSS 9.8): A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication,…
- CVE-2025-47928 — Critical (CVSS 9.1): Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using…
- CVE-2024-27455 — Critical (CVSS 9.1): In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token…
- CVE-2026-86492 — High (CVSS 8.5): In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation…