CVE-2026-78573
This vulnerability (CVE-2026-78573) affects IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.7, allowing remote attackers to gain administrative access by exploiting default credentials. It is classified as critical (CVSS 9.8) and stems from improper authentication (CWE-1392).
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
IBM ContextForge MCP Gateway 1.0.0 through 1.0.7
Real-world impact
An unauthenticated remote attacker can obtain administrative privileges, potentially leading to full system compromise.
Why this severity
Critical severity (CVSS 9.8) indicates a very high likelihood of impact if exploited successfully.
What to do about it
- ›Immediately change all default credentials to strong, unique passwords.
- ›Apply any available patches or updates once released by the vendor.
- ›Restrict network access to the application to minimize exposure.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
Information derived from the NVD description and CISA KEV entry (no known exploited status, no public exploit available).