The Sandbox That Was Not One: CVE-2026-53710 in IBM mcp-context-forge

A CVSS 10.0 escape in IBM mcp-context-forge shows why an allowlist of builtins cannot contain Python, and what to check instead.