Medium severity · published Oct 13, 2026
CVE-2026-53711
MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI
5.1
CVSS
0.4%
EPSS
No
On KEV
Description
MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output encoding before the MCP Admin UI renders it. An authenticated attacker can save markup containing script-capable event handlers, and the code executes when another user views the saved prompt. The stored cross-site scripting can alter the interface, present phishing content, observe keystrokes available to the page, and act with the viewer's browser session. This issue is fixed in version 0.3.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
mcp-context-forge · IBM
>= 0.2.0, < 0.3.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53711
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-53711
x_refsource_CONFIRM
https://github.com/IBM/mcp-context-forge/security/advisories/GHSA-x6gc-rm5j-55mw
x_refsource_MISC
https://github.com/IBM/mcp-context-forge/pull/337
x_refsource_MISC
https://github.com/IBM/mcp-context-forge/commit/acd16196158f9a393187551b21a2fc61650f2e3d
x_refsource_MISC
https://github.com/IBM/mcp-context-forge/releases/tag/v0.3.1
More from mcp-context-forge
10.0
CVE-2026-53710
MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
9.8
CVE-2026-53709
MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery
6.6
CVE-2026-53708
ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)