Disclosed vulnerability
CVE-2026-53710: unauthenticated RCE in IBM MCP Context Forge python_sandbox_server (RestrictedPython getattr bypass)
AIR-2026-0244 AIR record · 2026-09-ibm-context-forge-sandbox-rce
From the supporting source
An attacker can construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands with the server process privileges through the execute_code MCP tool.github.com
The record
Disclosed
2026-09-15
Vendor
IBM
Product
IBM MCP Context Forge (python_sandbox_server subproject)
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
AI was the target — unauthenticated MCP sandbox flaw; agent tooling is the attacked endpoint
Attack surface
MCP server
Autonomy level
Assistant
Initial vector
Unauthenticated network request
Impact type
Sandbox escape, Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
mcp-context-forge python_sandbox_server < 1.0.2 reachable over HTTP/SSE
Capability abused
Defense & remediation
Recorded defense
RestrictedPython safe_builtins + validate_code literal-dunder blocklist
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
mcp-context-forge 1.0.2
Taxonomy & references
Curator notes
CVSS 10.0. GHSA-xm98-3vcf-fph7 (advisory published 2026-08-24; CVE published 2026-09-15). PoC executed against the pinned sandbox code path (marker command), no real-world victim. Affects only the python_sandbox_server subproject, not the core ContextForge gateway/proxy. Related but distinct ContextForge advisories in the same window (NOT folded here): CVE-2026-78573 default 'changeme' credentials (fixed 1.0.10) and CVE-2026-18486 jq-filter credential theft.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-53710: unauthenticated RCE in IBM MCP Context Forge python_sandbox_server (RestrictedPython getattr bypass)". AIR, AIR-2026-0244. https://agentincident.vercel.app/i/AIR-2026-0244/ (accessed 2026-10-19).