{
 "public_id": "AIR-2026-0244",
 "incident_id": "2026-09-ibm-context-forge-sandbox-rce",
 "date_disclosed": "2026-09-15",
 "date_occurred": null,
 "title": "CVE-2026-53710: unauthenticated RCE in IBM MCP Context Forge python_sandbox_server (RestrictedPython getattr bypass)",
 "class": "responsible_disclosure",
 "attack_surface": "mcp_server",
 "initial_vector": "unauthenticated_network_request",
 "agent_capability_abused": [
  "code_execution_tool",
  "http_sse_transport",
  "local_process_spawn"
 ],
 "target_product": "IBM MCP Context Forge (python_sandbox_server subproject)",
 "target_vendor": "IBM",
 "autonomy_level": "assistant",
 "impact_realized": false,
 "impact_type": [
  "sandbox_escape",
  "remote_code_execution"
 ],
 "blast_radius": "mcp-context-forge python_sandbox_server < 1.0.2 reachable over HTTP/SSE",
 "cve": [
  "CVE-2026-53710"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI05"
  ],
  "mitre_atlas": [],
  "labels": [
   "sandbox_escape",
   "code_injection",
   "restrictedpython_bypass",
   "mcp_server"
  ]
 },
 "defense_present": "RestrictedPython safe_builtins + validate_code literal-dunder blocklist",
 "defense_bypassed": true,
 "fix_shipped": "mcp-context-forge 1.0.2",
 "primary_sources": [
  "https://github.com/IBM/mcp-context-forge/security/advisories/GHSA-xm98-3vcf-fph7",
  "https://cveawg.mitre.org/api/cve/CVE-2026-53710"
 ],
 "verified_quote": "An attacker can construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands with the server process privileges through the execute_code MCP tool.",
 "confidence": "high",
 "notes": "CVSS 10.0. GHSA-xm98-3vcf-fph7 (advisory published 2026-08-24; CVE published 2026-09-15). PoC executed against the pinned sandbox code path (marker command), no real-world victim. Affects only the python_sandbox_server subproject, not the core ContextForge gateway/proxy. Related but distinct ContextForge advisories in the same window (NOT folded here): CVE-2026-78573 default 'changeme' credentials (fixed 1.0.10) and CVE-2026-18486 jq-filter credential theft.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Tool & Function Call Extraction / Abuse",
 "risk_sub_secondary": [
  "Remote Code Execution & Sandbox Escape"
 ],
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": false,
 "agency_reason": "unauthenticated MCP sandbox flaw; agent tooling is the attacked endpoint",
 "vector_family": "conventional_vulnerability",
 "vector_detail": "unauthenticated_network_request",
 "guardrail_kind": [
  "permission_scope"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [
   "CVE-2026-53710"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "mcp_server",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [],
 "eai_reason": "impact rule: privilege_escalation",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI05 (impact=code_exec)",
 "submitted_by": "EAI Internal"
}