{"cve":"CVE-2026-53710","nvd":{"published":"2026-09-15T17:17:19.117","modified":"2026-09-30T17:51:56.193","status":"Deferred","description":"MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr through safe_builtins, omits a required _getattr_ guard, and relies on validate_code checks for literal dangerous dunder strings. An attacker can construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands with the server process privileges through the execute_code MCP tool. The HTTP/SSE transport can expose this tool without authentication, while stdio-only deployments have reduced network reachability. The issue affects the python_sandbox_server subproject and does not directly affect the core Context Forge gateway or proxy components. This issue is fixed in version 1.0.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":10.0},"cwes":["CWE-94","CWE-693"],"references":["https://github.com/IBM/mcp-context-forge/commit/63a2900e6301b9c8a483a38d3737a1beb3a7ce89","https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.2","https://github.com/IBM/mcp-context-forge/security/advisories/GHSA-xm98-3vcf-fph7"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:53:43.293028046+00:00"},"epss":{"cve":"CVE-2026-53710","score":0.01141,"percentile":0.66434,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-xm98-3vcf-fph7","url":"https://osv.dev/vulnerability/GHSA-xm98-3vcf-fph7","summary":"mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server","modified":"2026-09-10T12:25:44.827501965Z","packages":[{"ecosystem":"PyPI","name":"mcp-contextforge-gateway","purl":"pkg:pypi/mcp-contextforge-gateway","ranges":["<1.0.2"],"fixed":["1.0.2"]}]},{"id":"PYSEC-2026-3862","url":"https://osv.dev/vulnerability/PYSEC-2026-3862","summary":"mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server","modified":"2026-09-10T12:15:11.009024125Z","packages":[{"ecosystem":"PyPI","name":"mcp-contextforge-gateway","purl":"pkg:pypi/mcp-contextforge-gateway","ranges":["<1.0.2"],"fixed":["1.0.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}