Skip to main content
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueRead More
Vulnerability Database/CVE-2026-55887

CVE-2026-55887: MCP Gateway Docker Label RCE Vulnerability

CVE-2026-55887 is a remote code execution flaw in MCP Gateway that allows malicious Docker images to execute arbitrary code on the host. This post explains its impact, affected versions, and mitigation steps.

Published:

CVE-2026-55887 Overview

CVE-2026-55887 is a container-creation-time boundary bypass in Docker MCP Gateway, a tool that manages the deployment of Model Context Protocol (MCP) servers. The flaw affects versions 0.21.0 through 0.42.1. Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label directly into the broad catalog.Server structure. Runtime-shaping fields including Volumes, User, and ExtraHosts were appended to the docker run argument vector without an origin allowlist. A malicious image author can request host filesystem or Docker socket mounts and UID 0 execution when a victim pulls or selects the image. The issue is fixed in version 0.42.2.

Critical Impact

A malicious OCI image can execute arbitrary code on the host by injecting docker run flags through image metadata, bypassing container isolation without needing in-container privilege escalation.

Affected Products

  • Docker MCP Gateway 0.21.0 through 0.42.1
  • pkg/oci/self_contained.go (direct docker:// references)
  • pkg/workingset/workingset.go (catalog snapshot imports)

Discovery Timeline

  • 2026-09-15 - CVE-2026-55887 published to NVD
  • 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-55887

Vulnerability Analysis

Docker MCP Gateway pulls MCP server images referenced with docker:// URIs or through catalog snapshot imports. During image resolution, the gateway reads the io.docker.server.metadata OCI label and YAML-unmarshals its contents directly into the catalog.Server Go struct. Because this struct includes runtime-shaping fields such as Volumes, User, and ExtraHosts, the label author controls values that are subsequently appended to the docker run argument vector. No origin allowlist filters which fields may originate from image metadata versus trusted catalog sources. This maps to argument injection [CWE-88].

Root Cause

The root cause is over-broad deserialization. The catalog.Server type mixes descriptive metadata with runtime configuration, so trusting any external source for the entire structure allows runtime configuration to be attacker-controlled. The fix introduces a narrower catalog.ImportedServer type that only accepts descriptive fields, then converts it to a Server via ToServer(), discarding runtime-shaping fields from untrusted origins.

Attack Vector

An attacker publishes an OCI image whose io.docker.server.metadata label declares volumes such as /:/host or /var/run/docker.sock:/var/run/docker.sock and sets User: 0. When a victim selects the image through the MCP Gateway, the gateway resolves it, unmarshals the label, and issues a docker run invocation that mounts the host filesystem or Docker socket into a root-owned container. Because container creation itself is misconfigured, no-new-privileges provides no protection — no in-container escalation is required.

go
// Patch: pkg/oci/self_contained.go - narrow OCI label schema
// Before: unmarshal directly into full catalog.Server
// After: unmarshal into restricted ImportedServer, then convert
-			var server catalog.Server
-			if err := yaml.Unmarshal([]byte(metadataLabel), &server); err != nil {
+			var imported catalog.ImportedServer
+			if err := yaml.Unmarshal([]byte(metadataLabel), &imported); err != nil {
 				return catalog.Catalog{}, nil, fmt.Errorf("failed to parse metadata label for %s: %w", serverName, err)
 			}

+			server := imported.ToServer()
 			server.Image = ociRef

Source: GitHub Commit 306d2d9

A companion patch in pkg/gateway/clientpool.go adds isSafeFlagValue filtering so any mount value that looks like a flag is skipped rather than appended to docker run:

go
 		if mount == "" {
 			continue
 		}
+		if !isSafeFlagValue(mount) {
+			log.Logf("Warning: tool '%s' has volume value that looks like a flag, skipping: %q", tool.Name, mount)
+			continue
+		}

 		args = append(args, "-v", mount)

Source: GitHub Commit 439b220

Stop Remote Code Execution Before It Runs

Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.

Stop Exploit Attempts

Detection Methods for CVE-2026-55887

Indicators of Compromise

  • Containers launched by MCP Gateway with bind mounts to sensitive host paths such as /, /etc, /root, or /var/run/docker.sock.
  • docker run invocations from the gateway process specifying --user 0, --user root, or unexpected --add-host entries sourced from OCI image labels.
  • OCI images referenced via docker:// whose io.docker.server.metadata label contains volumes:, user:, or extra_hosts: keys.

Detection Strategies

  • Inspect the running MCP Gateway version and confirm it is 0.42.2 or later; earlier versions are vulnerable regardless of image source.
  • Audit process command lines for docker run invocations spawned by MCP Gateway that include -v, --user, or --add-host flags derived from image metadata.
  • Scan pulled OCI images with docker inspect to enumerate io.docker.server.metadata label content and flag any that declare runtime-shaping fields.

Monitoring Recommendations

  • Alert on new containers whose mount specifications include the Docker socket or host root filesystem paths.
  • Track pulls of MCP server images from untrusted registries and correlate with subsequent container-creation events.
  • Log the full docker run argument vector emitted by the gateway to preserve forensic evidence of label-driven flags.

How to Mitigate CVE-2026-55887

Immediate Actions Required

  • Upgrade Docker MCP Gateway to version 0.42.2 or later, which introduces the narrowed ImportedServer schema.
  • Enumerate MCP server images currently referenced via docker:// URIs and remove any from untrusted publishers.
  • Restrict which users and workflows can add new MCP servers or import catalog snapshots into the gateway.

Patch Information

The fix ships in GitHub Release v0.42.2 and is described in GHSA-r2xf-7jw5-pjg6. The change is implemented in Pull Request #498, which narrows the OCI label schema to descriptive fields only and adds flag-value validation for mount arguments.

Workarounds

  • Only reference MCP server images from registries and publishers you explicitly trust; treat OCI image labels as attacker-controlled input.
  • Disable docker:// server references and catalog snapshot imports in gateway configuration until the upgrade is complete.
  • Run the MCP Gateway host process as a non-privileged user without membership in the docker group where operationally feasible.
bash
# Verify the installed MCP Gateway version and upgrade
docker mcp-gateway version

# Pull the fixed release
docker pull ghcr.io/docker/mcp-gateway:0.42.2

# Inspect an image label before allowing it in the gateway
docker inspect --format '{{ index .Config.Labels "io.docker.server.metadata" }}' <image>

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne