What happened
Published 2026-10-13 (CVSS 5.1) via GitHub advisory. Global Prompt templates render without sufficient output encoding. Pairs with CVE-2026-53709 in the same product. Verified via NVD REST API.
Why it matters
An XSS in an MCP gateway admin console is a privilege boundary crossing: any prompt the admin views can inherit the admin session and rewire the gateway's servers/tools that all downstream agents depend on.
Attack vector
The Global Prompts feature stores a prompt template without sufficient output encoding; rendering it in the MCP Admin UI executes script-capable event handlers in the context of an authenticated admin session (full control of the gateway the admin governs).
Affected systems
IBM MCP Context Forge MCP Admin UI 0.2.0–0.3.1
Mitigation
Upgrade MCP Context Forge to >= 0.3.2 (fix commit acd16196158f9a393187551b21a2fc61650f2e3d).