How severe is CVE-2026-53710?

No CVSS score has been assigned to CVE-2026-53710 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by CVE-2026-53710?

CVE-2026-53710 affects the following packages: mcp-contextforge-gateway (PyPI). Ecosystems affected: PyPI.

How do I fix CVE-2026-53710?

Update mcp-contextforge-gateway to 1.0.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-53710 is resolved across your whole dependency graph.

How do I detect CVE-2026-53710 in my PyPI dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for mcp-contextforge-gateway. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate CVE-2026-53710 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against CVE-2026-53710?

O3 pinpoints whether CVE-2026-53710 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is CVE-2026-53710 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-53710 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was CVE-2026-53710 published, and has it been updated?

CVE-2026-53710 was published on August 24, 2026 and was last updated on August 24, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐍 PyPI

Not in CISA KEV

CVE-2026-53710

Fix: IBM/mcp-context-forge@63a2900

CVE-2026-53710 is a security vulnerability in mcp-contextforge-gateway. O3 Security confirms whether CVE-2026-53710 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

Published

Aug 24, 2026

Updated

Aug 24, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Aug 24, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🐍mcp-contextforge-gateway

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Commit: f855e54d5b7bc1c91b977574a03b91eff6b86bb6 Component: mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py

Vulnerability

RestrictedPython's sandbox in ContextForge's python_sandbox_server sub-project allows arbitrary Python execution via three compounding weaknesses:

Raw getattr is exposed in safe_builtins, bypassing _getattr_ mediation.
validate_code checks for literal dangerous dunder strings, but the payload constructs those names at runtime.
The execute_code MCP tool can be exposed over HTTP/SSE transport with no authentication layer.

Proof of Concept

The local PoC was executed against the real pinned sandbox code path. It constructs dunder names at runtime, walks Python's class hierarchy through the exposed getattr, finds subprocess.Popen, and executes a harmless marker command.

Transcript excerpt:

POC: IBM/mcp-context-forge RestrictedPython getattr sandbox bypass
validation={'valid': True, 'message': 'Code passed validation', 'warnings': None}
success=True
stdout="FOUND_POPEN\nb'IBM_SANDBOX_POC_PASS'\n"
IBM_RESTRICTEDPYTHON_GETATTR_POPEN_REPRO_PASS

PoC artifact hashes:

beb2d856c5a1b7c10005c9c0fccaf3d491d4fbcc2a69bc54b5e95c5730c0874b  run.py
1037dcb4f0831a3c96ca728527f939af1d3e19514b23ef54f663707875748ff8  run.sh
7026e676ee31916886f10feed959ffdbe486fda05b17421387e4717acbf90ba6  transcript.txt

Production Deployment Context

ContextForge's documentation describes registering MCP servers as gateways in a running ContextForge instance. If this sandbox server is reachable over HTTP in that pattern, any client that can reach the endpoint can submit the payload through tools/call.

Impact

An attacker with access to the python_sandbox_server HTTP endpoint can execute OS commands with the privileges of the server process. In containerized deployments with host mounts or internal network reachability, this can become filesystem compromise or network pivoting from the gateway host.

Suggested Fix

Remove raw getattr and setattr from safe_builtins, expose only policy-controlled attribute access if dynamic lookup is required, replace substring filtering with a stricter RestrictedPython policy pipeline, and add authentication to HTTP transport for all tools/call requests.

Caveats

This report covers the python_sandbox_server sub-project. The core ContextForge gateway and proxy components are not directly affected. The Critical score assumes HTTP reachability; stdio-only deployments reduce the attack vector.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐍PyPI	`mcp-contextforge-gateway`	all versions	1.0.2

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for mcp-contextforge-gateway. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update mcp-contextforge-gateway to 1.0.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-53710 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-53710 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to CVE-2026-53710. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

**Commit:** `f855e54d5b7bc1c91b977574a03b91eff6b86bb6` **Component:** `mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py` ## Vulnerability RestrictedPython's sandbox in ContextForge's `python_sandbox_server` sub-project allows arbitrary Python execution via three compounding weaknesses: 1. Raw `getattr` is exposed in `safe_builtins`, bypassing `_getattr_` mediation. 2. `validate_code` checks for literal dangerous dunder strings, but the payload constructs those names at runtime. 3. The `execute_code` MCP tool can be exposed over HTTP/SSE transport with no

O3 Security · Impact-Aware SCA

Is CVE-2026-53710 in your dependencies?

O3 detects CVE-2026-53710 across PyPI dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works