MEDIUMCVSS v3.1 5.4Vulnerability
CVE-2026-110195
IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow an authenticated caller to bypass upstream credential-level authorization policies due to an insufficiently specific cache key in the RFC 8693 token exchange cache, enabling reuse of cached upstream bearer tokens across different credentials belonging to the same user.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Cvss severity
- MEDIUM
- Cvss score
- 5.4
- Retrieved at
- 2026-11-14T00:50:05+00:00
- Score
- 5.4
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-110195
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- First seen by Signal
- 2026-11-14T00:50:05+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Published at
- 2026-11-13T22:17:20.627
- Last modified
- 2026-11-13T22:17:20.733
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph