@rog0x/mcp-docker-tools EUVD-2026-109094

Exploitation requires the @rog0x/mcp-docker-tools MCP server (v1.0.1) to be deployed and an operator or AI agent to invoke the affected Docker image-listing capability (reflected by UI:R), and the attacker must control data that reaches the handleImageList function (e.g., a crafted image name or registry/response value). The CVSS AC:H indicates non-trivial, specific conditions must be met rather than a default-path trigger; however, the exact triggering mechanism is not described in the available sources. Limiting factors that reduce realistic risk: mandatory user/operator interaction, the very narrow installed base of this package, and the absence of a confirmed working exploit. No vendor-stated non-default configuration requirement is documented in the evidence.

The input provides a CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), which is severity-high but carries two meaningful dampeners: high attack complexity (AC:H) and required user interaction (UI:R). PR:N indicates the vulnerable tool itself enforces no authentication, so exploitation is unauthenticated against the component, but it still depends on an operator (or AI agent) invoking the affected tool. No EPSS probability is supplied, so likelihood of opportunistic exploitation cannot be quantified. The CVE is NOT in CISA KEV and there is no confirmed PoC line in the input; a GitHub issue reference exists (and notably points at a sibling project, mcp-git-tools, not mcp-docker-tools), but it is not verified as working exploit code. No SSVC technical-impact/automatable breakdown is provided beyond the vendor priority 'this_week'. Weighing these signals together, this reads as a genuine code-execution flaw but in a very low-footprint npm package, so real-world aggregate risk is modest despite the 'RCE' label - closer to a targeted/supply-chain concern for the few consumers of this specific package than a widespread emergency. Missing data (EPSS absent, no KEV, PoC unverified, CWE N/A) should be treated as unknowns, not as evidence of safety.

An attacker influences data that flows into the Docker image-listing routine - for example a crafted image name or registry response - so that when an operator or AI agent invokes the image-list tool exposed by the MCP server, attacker-controlled input reaches handleImageList and executes arbitrary commands on the host running the server. A GitHub issue reference exists but is not verified as working exploit code, and the CVSS AC:H/UI:R metrics indicate the attack requires both specific conditions and an operator action rather than a one-shot remote hit.