CVE-2026-55887
Received Received - Intake

Privilege Escalation in MCP Gateway via Malicious OCI Image Labels

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot imports in pkg/oci/self_contained.go and pkg/workingset/workingset.go. Runtime-shaping fields including Volumes, User, and ExtraHosts were then appended to the docker run argument vector without an origin allowlist, allowing a malicious image author to request host filesystem or Docker socket mounts and UID 0 execution when a victim selected or pulled the image. This container-creation-time boundary bypass can execute arbitrary code on the host and is not prevented by no-new-privileges because no in-container privilege escalation is required. This issue is fixed in version 0.42.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-55887
EUVD
EUVD-2026-78684

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
docker mcp_gateway 0.42.2
docker mcp_gateway From 0.21.0 (inc) to 0.42.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55887 is a vulnerability in Docker MCP Gateway versions 0.21.0 to 0.42.1 where a malicious OCI image label can inject arbitrary arguments into the docker run command. The io.docker.server.metadata label is unmarshalled into runtime-shaping fields like Volumes, User, and ExtraHosts without validation. These fields are then appended to docker run arguments, allowing command injection. The issue bypasses container trust boundaries and is not mitigated by no-new-privileges.

Impact Analysis

An attacker who controls an image can mount the host filesystem, run as root (UID 0), and execute arbitrary code on the host system when a victim selects or pulls the image. This allows full compromise of the host environment.

Mitigation Strategies

Upgrade Docker MCP Gateway to version 0.42.2 or later to patch the vulnerability. Avoid using images with untrusted io.docker.server.metadata labels until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55887. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart