{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mcp-contextforge-gateway/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mcp-contextforge-gateway"],"_cs_severities":["high"],"_cs_tags":["mcp-contextforge-gateway","ssti","rce","vulnerability"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe mcp-contextforge-gateway service, up to version 0.9.0, is vulnerable to Server-Side Template Injection (SSTI) due to the use of a plain, unsandboxed Jinja2 Environment for rendering user-supplied prompt templates. The vulnerability exists within \u003ccode\u003emcpgateway/services/prompt_service.py\u003c/code\u003e in the \u003ccode\u003e_render_template\u003c/code\u003e method. By registering or updating a prompt template via the gateway's REST API, an authenticated user can inject arbitrary Jinja2 syntax. Because the environment does not restrict attribute traversal or function calls, an attacker can access Python built-ins such as \u003ccode\u003e__builtins__.__import__\u003c/code\u003e to execute arbitrary commands. This allows for full host compromise, including access to environment variables, credentials, and persistent modifications to the gateway host. This issue was resolved in version 1.0.0 by migrating to a \u003ccode\u003ejinja2.sandbox.SandboxedEnvironment\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains valid credentials for the mcp-contextforge-gateway service with permissions to register or update prompt templates.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious Jinja2 payload utilizing the \u003ccode\u003eself.__init__.__globals__.__builtins__\u003c/code\u003e chain to reach the \u003ccode\u003eos\u003c/code\u003e module.\u003c/li\u003e\n\u003cli\u003eAttacker submits the crafted template content to the gateway via the \u003ccode\u003ePOST /prompts\u003c/code\u003e or \u003ccode\u003ePUT /prompts/{id}\u003c/code\u003e REST API endpoint.\u003c/li\u003e\n\u003cli\u003eThe gateway stores the malicious template string in its backend database.\u003c/li\u003e\n\u003cli\u003eThe attacker or another process triggers the \u003ccode\u003eprompts/get\u003c/code\u003e flow through the gateway.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ePromptService.get_prompt\u003c/code\u003e method calls \u003ccode\u003e_render_template\u003c/code\u003e with the stored, malicious template.\u003c/li\u003e\n\u003cli\u003eThe unsandboxed \u003ccode\u003ejinja2.Environment\u003c/code\u003e interprets and executes the embedded Python commands at render-time.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves Remote Code Execution with the permissions of the gateway service process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full host compromise under the security context of the gateway process. Attackers gain the ability to read or modify files on the gateway host, exfiltrate sensitive environment variables (e.g., API keys, database credentials), and move laterally within the network. In multi-tenant environments, a single compromised tenant account can lead to a complete takeover of the gateway, affecting all other tenants.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all instances of \u003ccode\u003emcp-contextforge-gateway\u003c/code\u003e to version 1.0.0 or higher immediately to address the use of the unsandboxed Jinja2 environment.\u003c/li\u003e\n\u003cli\u003eAudit prompt templates currently stored in the gateway database for suspicious Jinja2 syntax or external references.\u003c/li\u003e\n\u003cli\u003eReview access logs for the \u003ccode\u003ePOST /prompts\u003c/code\u003e and \u003ccode\u003ePUT /prompts/{id}\u003c/code\u003e endpoints to identify unauthorized or anomalous template registration activity.\u003c/li\u003e\n\u003cli\u003eRestrict permissions for registering or updating prompt templates to a limited set of trusted users to reduce the attack surface.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-25T18:49:45Z","date_published":"2026-08-25T18:49:45Z","id":"https://feed.craftedsignal.io/briefs/2026-08-mcp-contextforge-ssti/","summary":"An authenticated Server-Side Template Injection (SSTI) vulnerability in mcp-contextforge-gateway version 0.9.0 and earlier allows attackers to achieve Remote Code Execution via unsandboxed Jinja2 template rendering.","title":"Remote Code Execution via SSTI in mcp-contextforge-gateway","url":"https://feed.craftedsignal.io/briefs/2026-08-mcp-contextforge-ssti/"}],"language":"en","title":"CraftedSignal Threat Feed - Mcp-Contextforge-Gateway","version":"https://jsonfeed.org/version/1.1"}