CVE-2026-53710: mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

August 24, 2026 (updated October 15, 2026)

Commit: f855e54d5b7bc1c91b977574a03b91eff6b86bb6 Component: mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py

References

github.com/IBM/mcp-context-forge/commit/63a2900e6301b9c8a483a38d3737a1beb3a7ce89
github.com/IBM/mcp-context-forge/releases
github.com/IBM/mcp-context-forge/security/advisories/GHSA-xm98-3vcf-fph7
github.com/advisories/GHSA-xm98-3vcf-fph7
nvd.nist.gov/vuln/detail/CVE-2026-53710

Code Behaviors & Features

Detect and mitigate CVE-2026-53710 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →