EUVD-2026-78684
GHSA-r2xf-7jw5-pjg6
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Argument sanitization
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 15, 2026
Argument injection in Docker MCP Gateway 0.21.0 through 0.42.1 allows an attacker who controls an OCI image — one the victim references via a docker:// URI or that the victim's catalog snapshots — to smuggle arbitrary flags into the docker run command line assembled by the gateway, binding the host root filesystem into the container and running as UID 0. Because the injected arguments (for example -v /:/host, -u root, and a mounted /var/run/docker.sock) take effect at container-creation time, the gateway's --security-opt no-new-privileges setting offers no protection and the attacker obtains root-level code execution on the gateway host. Vendor-released patch: 0.42.2; no public exploit code identified at time of analysis and no CISA KEV confirmation of active exploitation.
Earlier versions of this analysis (1)
Arbitrary code execution as root on the host running Docker MCP Gateway via argument injection in the docker run command line. A malicious OCI image author can craft an io.docker.server.metadata label that YAML-unmarshals into runtime-shaping fields of the catalog.Server struct, causing the gateway to append attacker-chosen flags like -v /:/host and -u root when launching the MCP server container. No public exploit identified at time of analysis, but the upstream advisory describes a full exploitation path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Docker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Image is fetched over the network (AV:N) but requires the victim to reference an attacker-controlled image (UI:R) and supply-chain positioning (AC:H); no gateway auth needed (PR:N); container-host boundary crossed (S:C) with full host compromise.
Primary rating from Vendor (https://github.com/docker/mcp-gateway).
CVSS VectorVendor: https://github.com/docker/mcp-gateway
Lifecycle Timeline
2DescriptionCVE.org
Summary
A maliciously crafted OCI image label can inject arbitrary arguments into the docker run command line constructed by the MCP Gateway. An attacker who controls an image that the victim references via docker://, or that the victim's catalog pulls a snapshot from, can mount the host filesystem, run as UID 0, and execute arbitrary code on the host.
Details
The io.docker.server.metadata OCI image label is YAML-unmarshalled directly into the wide catalog.Server struct, which carries runtime-shaping fields (Volumes, User, Command, ExtraHosts, AllowHosts, DisableNetwork, Env, Remote, SSEEndpoint, OAuth,Secrets, LongLived, Policy) alongside descriptive fields. Every runtime field carries a YAML tag, so the unmarshal mass-assigns from the attacker-controlled label content; only Image is overwritten afterwards. The gateway's container-launch code then appends those fields verbatim as docker run flags (-v, -u, --add-host) with no allowlist or origin check, and execs docker with the resulting argv.
Impact
A malicious image author can achieve arbitrary code execution as UID 0 on the host of a victim running an affected version of MCP Gateway. Attacker-injected -v /:/host, -u root, and -v /var/run/docker.sock:/var/run/docker.sock arguments reach the docker run invocation that launches the MCP server container, giving the attacker full host filesystem access and root execution. The container/host trust boundary is bypassed at container-creation time, so the --security-opt no-new-privileges flag the gateway applies provides no protection: no in-container privilege escalation is needed.
Patches
The OCI image-label parser now only populates descriptive fields from the image label, which excludes fields that control the container runtime.
Credit
This issue was reported by Jabr Al-Otaibi @ DarkCov working with TrendAI Zero Day Initiative
Articles & Coverage 1
Zero Day Initiative Advisories
Executive ViewAI
Docker MCP Gateway contains a vulnerability that allows attackers with control over container images to gain complete access to affected host systems, compromising all applications and data running on them. Organizations using this gateway with externally-sourced containers face significant risk of infrastructure compromise.
Within 24 hours: Inventory all Docker MCP Gateway deployments and identify which systems process untrusted or externally-sourced container images. Within 7 days: Implement image source restrictions to allow only pre-vetted and internally-managed containers, and isolate vulnerable systems from production networks. Within 30 days: Monitor the upstream project for security patch availability and establish upgrade procedures once released.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict container image sources to internal registries or explicitly approved external sources only; (2) Implement network segmentation to prevent compromised systems from accessing critical infrastructure; (3) Apply strict container runtime policies (AppArmor/SELinux) to limit privilege escalation; (4) Enable comprehensive monitoring and alerting on container execution and label parsing activities.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Unauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Same technique Privilege Escalation
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Exploit-DB