CVE-2026-77822 is a high severity (CVSS 8.2) server-side request forgery in IBM ContextForge MCP Gateway, through DNS rebinding on the A2A invoke endpoint. An authenticated low privilege user can reach internal resources. Upgrade to v1.0.9, or disable A2A as a short-term step.
What's affected
- Product: IBM ContextForge MCP Gateway.
- Affected: v1.0.8 and earlier.
- Fixed: v1.0.9.
- Weakness: CWE-918, server-side request forgery.
- CVSS 8.2 (high), vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. Not listed in CISA KEV.
The weak spot is the Agent-to-Agent invoke endpoint. IBM says that, unlike other outbound paths in the gateway, it did not pin the DNS-resolved IP address at connection time.
How to check if you're exposed
Find the version of each gateway you run, from the image tag, package version or release you deployed.
Then check whether the A2A feature is turned on. The IBM bulletin names the setting MCPGATEWAY_A2A_ENABLED, so read its value in your environment. Also list who can create or invoke A2A agents, since the flaw needs an authenticated user. If A2A is on and you are on v1.0.8 or older, plan the upgrade now.
What to do now
- Upgrade ContextForge MCP Gateway to v1.0.9 or later.
- If you cannot upgrade, set
MCPGATEWAY_A2A_ENABLED=Falseto remove the endpoint, at the cost of A2A functionality. - Otherwise, revoke A2A creation and invoke permissions from users who do not need them.
- Add egress controls so the gateway cannot reach internal management networks or cloud metadata addresses.
- Review gateway logs for A2A invocations that resolved to internal addresses.
Why it matters
DNS rebinding works because a name can resolve to one address when it is checked and another when it is used. A defence that validates a hostname and then lets the HTTP library look it up again can be fooled. IBM says every other egress path in the gateway pins the resolved address, and this one did not.
The lesson is consistency. A safe request helper only helps if every path uses it. For gateways that call out on behalf of users, centralise outbound requests, pin the resolved address, and block internal ranges at the network too.
Quick check
Is the response returned to the caller?
IBM says the full response body is returned, which is why this is rated for high confidentiality impact.
Sources
Last reviewed: 19 October 2026.
