CVE-2026-53710: MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the pythonsandboxserver in mcp-servers/python/pythonsandboxserver/src/pythonsandboxserver/serverfastmcp.py exposes raw getattr through safebuiltins, omits a required getattr guard, and relies on validatecode checks for literal dangerous dunder strings. An attacker can construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands with the server process privileges through the executecode MCP tool. The HTTP/SSE transport can expose this tool without authentication, while stdio-only deployments have reduced network reachability. The issue affects the pythonsandboxserver subproject and does not directly affect the core Context Forge gateway or proxy components. This issue is fixed in version 1.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py (python_sandbox_server)to a version that resolves this vulnerability.Fixed in 1.0.2
Event History
Frequently Asked Questions
Which deployments are most exposed?
Deployments of the python_sandbox_server using the HTTP/SSE transport are most exposed because the execute_code MCP tool can be reachable without authentication. Stdio-only deployments have reduced network reachability. The core Context Forge gateway and proxy components are not directly affected.
What does an attacker need to exploit this issue?
An attacker needs access to the execute_code MCP tool on a vulnerable python_sandbox_server. They can bypass the RestrictedPython sandbox by constructing dangerous dunder names at runtime, then reach subprocess.Popen and execute operating-system commands with the server process privileges.
Are current patched releases affected?
The issue affects python_sandbox_server versions prior to 1.0.2. Version 1.0.2 fixes the issue.
What can be done if upgrading is not immediately possible?
Reduce access to the execute_code tool, especially where it is exposed through HTTP/SSE without authentication. Restrict network reachability and avoid exposing the vulnerable python_sandbox_server to untrusted users; stdio-only deployment reduces network reachability.