Why it matters
ContextForge is IBM's centralized gateway/registry for MCP, A2A, and REST/gRPC APIs — a control-plane component brokering agent-to-tool traffic. A DNS-rebind SSRF here can expose cloud credentials and internal network services to any user with a limited, database-backed role, an easy privilege step-up from partial to full internal-network access.
Attack vector
/admin/gateways/test validates the target hostname to reject private/loopback/link-local/cloud-metadata addresses, but ResilientHttpClient later re-resolves the same hostname without binding the validated address, so an attacker with gateways.read permission can use DNS rebinding to present a public address at validation time and a private/metadata address at connection time, reaching internal services and cloud metadata.
Affected systems
IBM/mcp-context-forge < 1.0.3 (MCPGATEWAY_ADMIN_API_ENABLED=true)
Mitigation
Upgrade to mcp-context-forge 1.0.3.