CVE-2026-18489
IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.4
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS probability
- 0.26%
- CWE
- CWE-488
- Published
- 2026-09-04
- Last modified
- 2026-09-04
Affected products
- IBM ContextForge MCP Gateway - Translate utility
Weakness type
Related vulnerabilities
- CVE-2026-84685 — Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management
- CVE-2026-86492 — In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub...
- CVE-2026-82367 — Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic
- CVE-2026-71850 — Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
- CVE-2026-16326 — consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
- CVE-2026-16498 — terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
- CVE-2026-54497 — view_component: Reused Component Instances Retain Stale Render Context
- CVE-2026-14621 — FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session