Description

ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validate_gateway_test_url() in mcpgateway/common/validators.py to resolve and reject private, loopback, link-local, and cloud-metadata addresses, but ResilientHttpClient later resolves the original hostname again without binding the validated address. When MCPGATEWAY_ADMIN_API_ENABLED is enabled, an attacker with a database-backed role containing explicit gateways.read permission can use DNS rebinding to return a public address during validation and a private or metadata address during connection, bypassing ssrf_blocked_networks and ssrf_dns_fail_closed because those controls apply only to the validation-time result. The endpoint's allow_admin_bypass=False setting means a bootstrap-only virtual platform-admin identity without a database role is not sufficient. Successful exploitation can reach internal services and cloud metadata, expose cloud credentials, access internal APIs, or probe internal network ports. This issue is fixed in version 1.0.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-09-14T16:17:11.883Z",
  "pubdate": "2026-09-14T16:17:11.883Z",
  "executiveSummary": "ContextForge versions prior to 1.0.3 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability due to a Time-of-Check to Time-of-Use (TOCTOU) flaw in the DNS resolution process.\nThe vulnerability resides in the /admin/gateways/test call site, where the application performs initial validation of a URL against internal and metadata address ranges, but fails to pin the resolved IP address for the subsequent connection request.\nBy employing DNS rebinding, an authenticated attacker can bypass network egress controls, specifically the ssrf_blocked_networks and ssrf_dns_fail_closed mechanisms.\nSuccessful exploitation requires the attacker to hold a database-backed role with explicit gateways.read permissions when MCPGATEWAY_ADMIN_API_ENABLED is active.\nThe impact includes unauthorized access to internal services, exfiltration of cloud metadata and associated credentials, internal API interaction, and reconnaissance of local network ports.\nThe issue is critical due to the potential for privilege escalation via cloud metadata services and the compromise of internal network segments reachable from the gateway server.",
  "technicalDetails": "The vulnerability originates in mcpgateway/admin.py within the /admin/gateways/test function, which utilizes validate_gateway_test_url() located in mcpgateway/common/validators.py to sanitize input URLs.\nWhile validate_gateway_test_url() correctly identifies and rejects requests directed at private, loopback, link-local, and cloud-metadata addresses based on a hostname resolution at the time of validation, the application fails to utilize the validated IP address for the actual network request.\nThe ResilientHttpClient component performs a secondary, independent DNS resolution when initiating the connection. Because the original hostname is resolved a second time, a DNS rebinding attack can be orchestrated by a malicious nameserver.\nAn attacker can return a legitimate, non-blocked public IP address during the initial validation phase to bypass ssrf_blocked_networks, and subsequently return a private, loopback, or cloud-metadata address (e.g., 169.254.169.254) during the connection phase performed by the ResilientHttpClient.\nBecause the connection request is not pinned to the initially validated IP, the bypass of ssrf_dns_fail_closed is total, as the security controls were only applied to the ephemeral validation-time result rather than the final connection destination.\nExploitation requires the attacker to possess a database-backed role containing explicit gateways.read permissions, as the endpoint enforces allow_admin_bypass=False, precluding anonymous or bootstrap-only access.\nOnce the target resolves the attacker-controlled DNS name to a sensitive internal resource, the ResilientHttpClient establishes a connection to the internal service on behalf of the gateway server.\nThis allows the attacker to interact with internal APIs, exfiltrate sensitive metadata documents (often containing IAM roles or instance credentials), or probe non-public network services within the infrastructure hosting ContextForge.\nThe disconnect between the validator and the transport layer creates a definitive TOCTOU window that invalidates the efficacy of the implemented URL filtering logic."
}