CVE-2026-78573

CriticalCVSS 9.8/10Last modified Sep 16, 2026

Description

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1392

Affected software

No affected versions have been published.

Timeline

Published
Sep 10, 2026
Last modified
Sep 16, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-785746.3The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity vCVE-2026-785758.8IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation oCVE-2026-785775.3Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, aCVE-2026-785787.1Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup.  An unauthenticatCVE-2026-785796.5The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datCVE-2026-78589.8A Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and MaCVE-2026-785814.2Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality CVE-2026-785826.5Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control SecCVE-2026-785838.1Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster CVE-2026-785844.3Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information CVE-2026-785866.5Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130CVE-2026-785873.1Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122)
CVE-2026-78573: Critical severity, CVSS 9.8 | Vulnix