Disclosed vulnerability
CVE-2026-18486: ContextForge jq filter exposes server environment secrets, enabling forged administrator tokens
AIR-2026-0259 AIR record · 2026-09-ibm-contextforge-jq-env-token-forgery
From the supporting source
MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters.ibm.com
The record
Disclosed
2026-09-04
Vendor
IBM
Product
IBM ContextForge MCP Gateway
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation
System type
Generative model
Who acted
AI was the target — filter feature in an MCP gateway exposes server secrets; no model action in the chain
Attack surface
MCP server
Autonomy level
Assistant
Initial vector
Authenticated developer tool configuration
Impact type
Credential exposure, Privilege escalation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
ContextForge MCP Gateway up to v1.0.7
Capability abused
Defense & remediation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
v1.0.8; IBM also advises rotating JWT_SECRET_KEY, AUTH_ENCRYPTION_SECRET, DATABASE_URL, REDIS_URL and BASIC_AUTH_PASSWORD on earlier deployments
Taxonomy & references
Curator notes
IBM bulletin (CVSS 8.8): a user with developer privileges can supply a jq program in a tool's filter field that runs unrestricted built-ins such as the environment accessor inside the server process, exposing keys and database credentials that can be used to forge administrator tokens. The OSV record shows publication on 2026-09-04, which is used as the disclosure date. No exploitation is reported. Different mechanism and advisory from the default-credentials record.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-18486: ContextForge jq filter exposes server environment secrets, enabling forged administrator tokens". AIR, AIR-2026-0259. https://agentincident.vercel.app/i/AIR-2026-0259/ (accessed 2026-10-19).