CVE-2026-55887
Severity not reportedMCP Gateway allows easy and secure running and deployment of MCP servers.
MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot imports in pkg/oci/self_contained.go and pkg/workingset/workingset.go. Runtime-shaping fields including Volumes, User, and ExtraHosts were then appended to the docker run argument vector without an origin allowlist, allowing a malicious image author to request host filesystem or Docker socket mounts and UID 0 execution when a victim selected or pulled the image. This container-creation-time boundary bypass can execute arbitrary code on the host and is not prevented by no-new-privileges because no in-container privilege escalation is required. This issue is fixed in version 0.42.2.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/docker/mcp-gateway/commit/306d2d94a3b526f43281313321bf784f2d46a7fe security-advisories@github.com
- https://github.com/docker/mcp-gateway/commit/439b2200d9e26a4ff414aeb043785df45a78422b security-advisories@github.com
- https://github.com/docker/mcp-gateway/pull/498 security-advisories@github.com
- https://github.com/docker/mcp-gateway/releases/tag/v0.42.2 security-advisories@github.com
- https://github.com/docker/mcp-gateway/security/advisories/GHSA-r2xf-7jw5-pjg6 security-advisories@github.com