mcp-contextforge-gateway RestrictedPython Sandbox Bypass via getattr (CVE-2026-53710)

let escapeGadgets = dynamic(["__class__","__bases__","__subclasses__","__globals__","__builtins__","__mro__","__import__","__reduce__","func_globals","getattr("]);
let suspiciousProcs = dynamic(["sh","bash","dash","os.system","subprocess","popen","/bin/sh","cmd.exe","powershell.exe"]);
(union isfuzzy=true
(Syslog
| where ProcessName has_any ("mcpgateway","python_sandbox_server","gateway")
| where SyslogMessage has_any (escapeGadgets) and SyslogMessage has "getattr"
| extend Signal="sandbox-gadget-in-log"),
(DeviceProcessEvents
| where InitiatingProcessFileName in~ ("python","python3","uvicorn","gunicorn") 
| where InitiatingProcessCommandLine has_any ("python_sandbox_server","mcpgateway","mcp-context-forge")
| where FileName in~ ("sh","bash","dash","cmd.exe","powershell.exe","whoami","id","curl","wget","nc")
| extend Signal="sandbox-child-process"))
| project TimeGenerated, Computer, Signal, ProcessName=coalesce(FileName,ProcessName), Details=coalesce(ProcessCommandLine,SyslogMessage)
| sort by TimeGenerated desc

(index=* (source=*mcpgateway* OR source=*python_sandbox_server* OR sourcetype=mcp:gateway) ("getattr" AND ("__class__" OR "__subclasses__" OR "__globals__" OR "__builtins__" OR "__bases__" OR "__mro__" OR "__import__")))
 OR (sourcetype IN ("linux:audit","Sysmon:Linux","XmlWinEventLog:Microsoft-Windows-Sysmon/Operational") parent_process=*python* (parent_process=*python_sandbox_server* OR parent_process=*mcpgateway*) (process_name IN ("sh","bash","dash","cmd.exe","powershell.exe","whoami","id","curl","wget","nc")))
| eval signal=if(match(_raw,"getattr"),"sandbox-gadget","sandbox-child-process")
| stats count min(_time) as firstTime max(_time) as lastTime values(process_name) as processes values(_raw) as sample by host signal
| convert ctime(firstTime) ctime(lastTime)

sequence by host.name with maxspan=30s
  [ process where process.name in ("python","python3","uvicorn","gunicorn") and
      process.command_line : ("*python_sandbox_server*","*mcpgateway*","*mcp-context-forge*") ]
  [ process where event.type == "start" and
      process.parent.name in ("python","python3") and
      process.name in ("sh","bash","dash","cmd.exe","powershell.exe","whoami","id","curl","wget","nc") ]

SELECT QIDNAME(qid) AS event, sourceip, destinationip, "Process Name" AS process, "Parent Process Name" AS parent, "Process CommandLine" AS cmd, payload
FROM events
WHERE (
  ("Parent Process Name" ILIKE '%python%' AND ("Parent Process CommandLine" ILIKE '%python_sandbox_server%' OR "Parent Process CommandLine" ILIKE '%mcpgateway%')
   AND "Process Name" IN ('sh','bash','dash','cmd.exe','powershell.exe','whoami','id','curl','wget','nc'))
  OR (UTF8(payload) ILIKE '%getattr%' AND (UTF8(payload) ILIKE '%__subclasses__%' OR UTF8(payload) ILIKE '%__globals__%' OR UTF8(payload) ILIKE '%__class__%' OR UTF8(payload) ILIKE '%__builtins__%'))
)
LAST 24 HOURS

(_sourceCategory=*mcpgateway* OR _sourceCategory=*python_sandbox* OR _sourceCategory=*gateway*)
| where (message matches /getattr/ and (message matches /__subclasses__/ or message matches /__globals__/ or message matches /__class__/ or message matches /__builtins__/ or message matches /__bases__/))
   or (parent_process matches /python(_sandbox_server|.*mcpgateway)/ and process_name in ("sh","bash","dash","cmd.exe","powershell.exe","whoami","id","curl","wget","nc"))
| if (message matches /getattr/, "sandbox-gadget", "sandbox-child-process") as signal
| count by _sourceHost, signal, process_name
| sort by _count desc

rule mcp_contextforge_sandbox_escape_cve_2026_53710 {
  meta:
    author = "argus"
    description = "RestrictedPython getattr sandbox bypass in mcp-contextforge-gateway (CVE-2026-53710)"
    severity = "CRITICAL"
    cve = "CVE-2026-53710"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      (re.regex($e.principal.process.parent_process.command_line, `python_sandbox_server|mcpgateway|mcp-context-forge`) and
       $e.target.process.file.full_path = /.*(\/sh|\/bash|\/dash|cmd\.exe|powershell\.exe|whoami|curl|wget|nc)$/)
      or
      re.regex($e.target.process.command_line, `getattr.*(__subclasses__|__globals__|__class__|__builtins__|__bases__)`)
    )
    $e.principal.hostname = $host
  match:
    $host over 5m
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| (ParentBaseFileName=/python/i AND (CommandLine=/python_sandbox_server/i OR CommandLine=/mcpgateway/i OR CommandLine=/mcp-context-forge/i))
| join({#event_simpleName=ProcessRollup2 ImageFileName=/(\/sh|\/bash|\/dash|cmd\.exe|powershell\.exe|whoami|curl|wget|nc)$/i}, field=[aid, ParentProcessId], key=[aid, TargetProcessId], include=[ImageFileName, CommandLine])
| groupBy([aid, ComputerName], function=collect([ImageFileName, CommandLine]))