CVE-2026-53710: mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

August 24, 2026 (updated September 2, 2026)

Commit: f855e54d5b7bc1c91b977574a03b91eff6b86bb6 Component: mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py

References

github.com/IBM/mcp-context-forge/commit/63a2900e6301b9c8a483a38d3737a1beb3a7ce89
github.com/IBM/mcp-context-forge/releases
github.com/IBM/mcp-context-forge/security/advisories/GHSA-xm98-3vcf-fph7
github.com/advisories/GHSA-xm98-3vcf-fph7
nvd.nist.gov/vuln/detail/CVE-2026-53710

Code Behaviors & Features

Detect and mitigate CVE-2026-53710 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →