CVE-2026-55887

Docker MCP Gateway versions 0.21.0 until 0.42.2 YAML-unmarshal the attacker-controlled io.docker.server.metadata OCI image label into a broad server structure when a victim uses direct docker:// references or imports catalog snapshots, in pkg/oci/self_contained.go and pkg/workingset/workingset.go. Runtime-shaping fields such as Volumes, User, and ExtraHosts are then appended to the docker run argument vector without any origin allowlist, so a malicious image author can request host filesystem or Docker socket mounts and UID 0 execution when the victim selects or pulls the image. This container-creation-time boundary bypass yields arbitrary code execution on the host and is not prevented by no-new-privileges because no in-container privilege escalation is involved. Anyone running affected versions who selects or imports images from untrusted authors is at risk. No public proof of concept or known in-the-wild exploitation has been reported.

What to do: Upgrade Docker MCP Gateway to version 0.42.2 or later, which adds origin allowlisting for these fields. Until patched, avoid selecting or pulling images via docker:// references or catalog snapshot imports from untrusted authors. Review host Docker run history for unexpected volume mounts (especially the Docker socket or host paths), ExtraHosts entries, or UID 0 User settings tied to images introduced through the gateway.