Description

MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr through safe_builtins, omits a required _getattr_ guard, and relies on validate_code checks for literal dangerous dunder strings. An attacker can construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands with the server process privileges through the execute_code MCP tool. The HTTP/SSE transport can expose this tool without authentication, while stdio-only deployments have reduced network reachability. The issue affects the python_sandbox_server subproject and does not directly affect the core Context Forge gateway or proxy components. This issue is fixed in version 1.0.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-15T17:17:19.117Z",
  "pubdate": "2026-09-15T17:17:19.117Z",
  "executiveSummary": "A critical Remote Code Execution (RCE) vulnerability exists in the python_sandbox_server component of MCP Context Forge prior to version 1.0.2.\nThe vulnerability originates from insufficient sandbox restrictions, specifically the exposure of raw getattr functionality and inadequate enforcement of safe_builtins.\nBy bypassing existing code validation checks, an unauthenticated attacker can traverse the Python class hierarchy to gain access to sensitive modules such as subprocess.\nSuccessful exploitation allows for the execution of arbitrary OS commands with the privileges of the server process.\nThe impact is severe, potentially leading to full system compromise if the server is deployed without proper transport-layer security or authentication.\nThe vulnerability specifically affects the python_sandbox_server subproject; core gateway and proxy components of Context Forge remain unaffected.\nRisk is amplified when the server is deployed using HTTP/SSE transport, which may expose the tool publicly without requiring prior authentication.\nRemediation requires an immediate upgrade to version 1.0.2 or later to ensure proper security constraints are enforced within the execution environment.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of object attribute access control within 'mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py'.\nThe 'python_sandbox_server' fails to implement a robust '_getattr_' guard, effectively exposing raw 'getattr' capabilities through 'safe_builtins'.\nWhile the application employs a 'validate_code' mechanism to block literal dangerous dunder strings, the validation logic is insufficient.\nAn attacker can bypass these filters by constructing dunder names dynamically at runtime, effectively obfuscating the intent of the code.\nBy iteratively traversing the Python class hierarchy, an attacker can escape the intended sandbox boundaries to access restricted modules.\nSpecifically, the attacker can navigate from available objects to 'subprocess.Popen', granting the ability to spawn system processes.\nThe attack flow follows a sequential path: First, the attacker provides a malicious payload to the 'execute_code' MCP tool.\nSecond, the payload leverages the broken 'getattr' mechanism to circumvent 'validate_code' string matching.\nThird, the attacker reaches the 'subprocess' module to execute arbitrary OS commands within the context of the server process.\nThe exposure of the 'execute_code' tool via HTTP/SSE protocols significantly lowers the barrier to entry, as it allows network-based exploitation without requiring authentication mechanisms on the transport layer.\nWhile stdio-only deployments provide a smaller attack surface, the inherent logic flaw remains present, allowing for local privilege escalation or compromise if the execution environment is shared.\nPost-exploitation impact includes unauthorized command execution, data exfiltration, and full control over the underlying server process.\nThis vulnerability is remediated in version 1.0.2, which introduces stricter attribute access policies and robust validation mechanisms to prevent dynamic dunder construction and class traversal."
}