IBM's ContextForge MCP Gateway draws six CVE records in ten days, one critical default-credentials bug already patched and one SSRF report closed by documentation alone

IBM's own CNA published five CVE records against ContextForge MCP Gateway between 2026-09-04 and 2026-09-10, and GitHub's separate CNA published a sixth against the same repository on 2026-09-14. Neither is cataloged here as an entity.

The critical record is CVE-2026-78573, CVSS 3.1 9.8, a hardcoded default credential of "changeme" across three password settings (platform_admin_password, default_user_password, basic_auth_password). When an operator enables basic authentication or the admin UI without setting these explicitly, the gateway accepts the known default and only logs a startup warning rather than refusing to start. The CVE record's own truncated version field names the affected range as ending at v1.0.7, but IBM's support page states the actual affected range runs through v1.0.9 and names v1.0.10, released 2026-09-07, three days before the record published on 2026-09-10, as the fix.

Four more IBM-track records follow, three with shipped fixes and one without. CVE-2026-18486 (high, 8.8) let an authenticated developer supply a jq filter that executed unrestricted builtins such as $ENV, exposing environment variables including cryptographic keys and database credentials; fixed in v1.0.8, released 2026-08-18. CVE-2026-77822 (high, 8.2) is a DNS-rebinding SSRF in the A2A agent invocation endpoint, the only outbound path in the gateway that did not pin the resolved IP at connection time; fixed in v1.0.9, released 2026-09-01. CVE-2026-18905 (high, 7.7) is a DNS TOCTOU SSRF at tool invocation, where a registered tool's URL is trusted without re-validation after registration; IBM's page dates the fixing merge to 2026-07-29, and the release, v1.0.7, followed on 2026-08-05. CVE-2026-18489 (high, 7.4), by contrast, has no code fix at all: IBM's page states the affected Translate utility "is intended only for local, single-session development use" and that a pull request merged 2026-08-24 only updated the documentation to make that restriction explicit, not the code.

Separately, GitHub's CNA published CVE-2026-53708 against the same repository on 2026-09-14, the latest date in this batch. It describes a DNS TOCTOU race condition that bypasses SSRF protection at the /admin/gateways/test endpoint, rated medium at CVSS 3.1 6.6. The fix, v1.0.3, was released 2026-06-10, the same day the CVE was reserved but three months before GitHub published the record.