MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-88.
Summary
MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot imports in pkg/oci/self_contained.go and pkg/workingset/workingset.go. Runtime-shaping fields including Volumes, User, and ExtraHosts were then appended to the docker run argument vector without an origin allowlist, allowing a malicious image author to request host filesystem or Docker socket mounts and UID 0 execution when a victim selected or pulled the image. This container-creation-time boundary bypass can execute arbitrary code on the host and is not prevented by no-new-privileges because no in-container privilege escalation is required. This issue is fixed in version 0.42.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Docker | mcp-gateway | 0.21.0 to before 0.42.2 | 0.42.2 | Patch available | CNA |
| — | github.com/docker/mcp-gateway (Go) | 0.21.0 to before 0.42.2 | 0.42.2 | Patch available | GHSA-r2xf-7jw5-pjg6 |
- mcp-gateway VendorDocker Affected 0.21.0 to before 0.42.2 Fixed in 0.42.2 Patch available CNA
- github.com/docker/mcp-gateway (Go) Vendor— Affected 0.21.0 to before 0.42.2 Fixed in 0.42.2 Patch available GHSA-r2xf-7jw5-pjg6
Remediation
- Fix · CNA mcp-gateway (docker) Fixed in 0.42.2
- Fix · GHSA-r2xf-7jw5-pjg6 github.com/docker/mcp-gateway (Go) Fixed in 0.42.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55887
- 2026-10-03 Alias added: GHSA-r2xf-7jw5-pjg6
References
Other 6
- https://github.com/docker/mcp-gateway/security/advisories/GHSA-r2xf-7jw5-pjg6
- https://github.com/docker/mcp-gateway/pull/498
- https://github.com/docker/mcp-gateway/commit/306d2d94a3b526f43281313321bf784f2d46a7fe
- https://github.com/docker/mcp-gateway/commit/439b2200d9e26a4ff414aeb043785df45a78422b
- https://github.com/docker/mcp-gateway/releases/tag/v0.42.2
- https://github.com/docker/mcp-gateway
More Docker vulnerabilities
- TI-2019-11833 Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by… KEVCVSS 3.1HIGH 7.8
- TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
- TI-2025-08316 Docker Desktop allows unauthenticated access to Docker Engine API from containers CVSS 4.0CRITICAL 9.3
- TI-2025-02823 Elevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory Deletion CVSS 4.0HIGH 7.3
- TI-2026-14229 Tar extraction in moby/go-archive can write outside the destination directory via link following CVSS 4.0HIGH 7.1
- TI-2023-21271 Docker Machine through 0.16.2 allows an attacker, who has control of a worker node, to… CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-55887 · CVE Program
- CVE-2026-55887 · NVD
- FIRST EPSS
- GHSA-r2xf-7jw5-pjg6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences