getattr, spelled at runtime
IBM’s MCP Context Forge shipped a Python sandbox that checked for dunder names as strings
CVE-2026-53710 scores 10.0. An attacker builds the forbidden name at runtime, walks the class hierarchy to subprocess.Popen, and runs commands through the execute_code tool.
The NVD published CVE-2026-53710 on 15 September at 10.0 out of 10, for the Python sandbox that ships with IBM’s MCP Context Forge.
Versions before 1.0.2 are affected. The record describes a blocklist doing a guard’s job. The sandbox “exposes raw getattr through safe_builtins, omits a required _getattr_ guard, and relies on validate_code checks for literal dangerous dunder strings”. A check for the string __subclasses__ does nothing against code that assembles those characters at runtime, so an attacker can “construct dunder names at runtime, traverse the Python class hierarchy, reach subprocess.Popen, and execute OS commands with the server process privileges”, all through the execute_code MCP tool the sandbox exists to offer.
Reach depends on transport, which ties it to the lead: the record says the HTTP or SSE transport “can expose this tool without authentication”, while stdio-only deployments “have reduced network reachability”. It also confines the fault to the sandbox subproject and says the core gateway and proxy are not directly affected.
A second Context Forge record from 14 September, CVE-2026-53708 at 6.6, concerns the gateway’s URL validator on the admin test route, and is fixed in 1.0.3, one version later than the sandbox fix.
What it changes If you run the python_sandbox_server, upgrade to 1.0.2 and move it off HTTP or SSE unless something authenticates callers. If you wrote your own sandbox on a string blocklist, assume it has this hole.
Primary source read
NVD record, CVE-2026-53710 GHSA-xm98-3vcf-fph7, IBM/mcp-context-forge