CVE-2026-55887

Deferred Deferred - Pending Action

Privilege Escalation in MCP Gateway via Malicious OCI Image Labels

Publication date: 2026-09-15

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot imports in pkg/oci/self_contained.go and pkg/workingset/workingset.go. Runtime-shaping fields including Volumes, User, and ExtraHosts were then appended to the docker run argument vector without an origin allowlist, allowing a malicious image author to request host filesystem or Docker socket mounts and UID 0 execution when a victim selected or pulled the image. This container-creation-time boundary bypass can execute arbitrary code on the host and is not prevented by no-new-privileges because no in-container privilege escalation is required. This issue is fixed in version 0.42.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-30

Generated

2026-10-06

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-04

NVD

CVE-2026-55887

EUVD

EUVD-2026-78684

Affected Vendors & Products

Vendor	Product	Version / Range
docker	mcp_gateway	0.42.2
docker	mcp_gateway	From 0.21.0 (inc) to 0.42.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

CVE-2026-55887 is a vulnerability in Docker MCP Gateway versions 0.21.0 to 0.42.1 where a malicious OCI image label can inject arbitrary arguments into the docker run command. The io.docker.server.metadata label is unmarshalled into runtime-shaping fields like Volumes, User, and ExtraHosts without validation. These fields are then appended to docker run arguments, allowing command injection. The issue bypasses container trust boundaries and is not mitigated by no-new-privileges.

Detection Guidance

To detect this vulnerability, check if your Docker MCP Gateway version is between 0.21.0 and 0.42.1. Run: docker exec <mcp-gateway-container> mcp-gateway version. If the version is in this range, the system is vulnerable. Additionally, inspect OCI image labels for io.docker.server.metadata to ensure they do not contain runtime-shaping fields like Volumes, User, or ExtraHosts.

Impact Analysis

An attacker who controls an image can mount the host filesystem, run as root (UID 0), and execute arbitrary code on the host system when a victim selects or pulls the image. This allows full compromise of the host environment.

Compliance Impact

This vulnerability allows arbitrary code execution on the host system with root privileges, which could lead to unauthorized access to sensitive data. This violates GDPR's integrity and confidentiality principles and HIPAA's security rule requirements for protecting patient data.

Mitigation Strategies

Upgrade Docker MCP Gateway to version 0.42.2 or later to patch the vulnerability. Avoid using images with untrusted io.docker.server.metadata labels until patched.

Hi! I’m here to help you understand CVE-2026-55887. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70