What happened
IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 does not validate the oauth_config.token_url during OAuth-enabled gateway registration. An authenticated user with gateway-creation privileges can supply a malicious token_url pointing to internal services, cloud-metadata endpoints (AWS IMDSv1, GCP, Azure) or localhost. The app immediately POSTs form-encoded credentials to that URL, and up to 256 characters of the response are reflected back in an HTTP 502 — bypassing SSRF protections applied to gateway.url but not the OAuth config.
Why it matters
In an MCP gateway the operator controls which third-party tools agents reach; a forged token_url lets a low-privileged gateway creator read cloud instance metadata (IAM creds) or hit internal services using the gateway's own credentials, then exfiltrate reflected responses. It is a concrete credential/SSRF path in enterprise MCP infrastructure.
Attack vector
Authenticated gateway-registration supply of a malicious oauth_config.token_url that forces an outbound POST and reflects part of the response
Affected systems
IBM ContextForge MCP Gateway 0.1.0 through 1.0.5
Mitigation
Follow IBM advisory (ibm.com/support/pages/node/7285723); validate/allow-list OAuth token_url and block private/loopback/metadata endpoints