What happened
Published 2026-10-13 (CVSS 9.8, CWE-287/321/798/1188) via GitHub advisory. The gateway ships a known JWT_SECRET_KEY and verify_jwt_token() accepts HS256 tokens signed with it, while get_current_user() promotes the token subject to platform administrator when REQUIRE_USER_IN_DB is false. Verified via NVD REST API.
Why it matters
MCP gateways are the trust boundary between agents and the tools/data they call. A forged admin token grants read/write/disruption of all gateway-managed MCP servers and resources, letting an attacker reconfigure what every connected agent can reach — a single point of compromise for an organisation's agent estate, and the fabricated-session path outlives normal credential-revocation controls.
Attack vector
Unauthenticated remote attacker signs an HS256 JWT with the publicly known JWT_SECRET_KEY shipped in mcpgateway/config.py and .env.example, sets the subject to the configured PLATFORM_ADMIN_EMAIL; get_current_user() mints an admin session without any DB account (REQUIRE_USER_IN_DB=false default). Forged tokens survive password changes, account deletion, and session revocation.
Affected systems
IBM MCP Context Forge MCP gateway < 1.0.2
Mitigation
Upgrade MCP Context Forge to 1.0.2; deployers must rotate the JWT secret and disable the platform-admin bootstrap; see GHSA-m8rv-5m6m-32ff.