CVE-2026-116102
Received Received - Intake

Command Injection in docker-mcp

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function _build_windows_command of the file docker_executor.py. This manipulation of the argument project_name causes os command injection. It is possible to initiate the attack remotely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116102
EUVD
EUVD-2026-109587

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
QuantGeekDev docker-mcp 0.1.0
QuantGeekDev docker-mcp 0.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in QuantGeekDev docker-mcp versions 0.1.0 and 0.2.0. It exists in the _build_windows_command function of docker_executor.py where the project_name argument is manipulated to inject and execute arbitrary operating system commands. The attack can be initiated remotely.

Detection Guidance

To detect this vulnerability, inspect the docker_executor.py file for the _build_windows_command function. Look for improper handling of the project_name argument that could allow command injection. Check Docker containers running QuantGeekDev docker-mcp 0.1.0 or 0.2.0 for suspicious processes or network activity.

Impact Analysis

An attacker could exploit this to execute unauthorized commands on the affected system. This may lead to data theft, system compromise, or further network infiltration depending on the permissions of the docker-mcp service.

Compliance Impact

This vulnerability allows remote command injection via the project_name argument in docker_executor.py, which could lead to unauthorized system access or data exfiltration. Such risks may violate GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Immediately update or patch the docker-mcp software to a version that fixes the os command injection vulnerability in docker_executor.py. If no patch is available, consider disabling or removing the affected software until a fix is provided.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116102. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart