What happened
IBM ContextForge MCP Gateway 1.0.0-1.0.8 admin API endpoint GET /v1/admin/logs/file uses str.startswith() for path confinement, allowing an authenticated admin to read .log/.jsonl/.json files outside LOG_FOLDER by choosing a sibling-directory filename sharing the log directory string prefix.
Why it matters
An MCP gateway admin account reading arbitrary JSON/log files on the host could expose agent runtime secrets, LLM API keys, or captured tool traffic outside the intended log sandbox in production agent gateways.
Attack vector
Authenticated admin crafts a log filename resolving into a sibling directory sharing the log path prefix to read arbitrary .log/.jsonl/.json files.
Affected systems
IBM ContextForge MCP Gateway 1.0.0-1.0.8
Mitigation
Apply IBM update per node/7289314; restrict admin access to the gateway.