Disclosed vulnerability
CVE-2026-78573: IBM ContextForge MCP Gateway ships default credentials that grant administrative access
AIR-2026-0260 AIR record · 2026-09-ibm-contextforge-default-credentials
From the supporting source
MCP Context Forge could allow a remote attacker to gain administrative access due to the use of default credentials.ibm.com
The record
Disclosed
2026-09-10
Vendor
IBM
Product
IBM ContextForge MCP Gateway
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
AI was the target — shipped default credentials on an MCP gateway; no model action in the chain
Attack surface
MCP server
Autonomy level
Assistant
Initial vector
Default credentials
Impact type
Unauthorized administrative access
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
ContextForge MCP Gateway 1.0.0 through 1.0.7
Capability abused
Defense & remediation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
v1.0.10, per IBM's security bulletin
Taxonomy & references
Curator notes
IBM's own security bulletin carries the quote. It explains that three password settings (platform admin, default user and basic-auth passwords) ship with a publicly known default value; if an operator enables basic authentication or the administrative interface without setting a password, the gateway accepts the default and only logs a startup warning. The bulletin rates it critical (CVSS 9.8) and tells operators to upgrade to v1.0.10 and set strong passwords before enabling those features. The bulletin is inconsistent about scope: its affected-versions table says v1.0.0 to v1.0.7, while its fix table says v1.0.0 to v1.0.9; the blast radius above follows the affected table, and the wider range may apply. The GitHub advisory GHSA-87q9-x2gp-qchr and the OSV record repeat the CVE description (published 2026-09-10) as '1.0.0 through 1.0.7'. No exploitation is reported. A separate ContextForge record covers the jq filter flaw; the earlier ContextForge record in the corpus (CVE-2026-53710) is a different CVE.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-78573: IBM ContextForge MCP Gateway ships default credentials that grant administrative access". AIR, AIR-2026-0260. https://agentincident.vercel.app/i/AIR-2026-0260/ (accessed 2026-10-19).