CVE-2026-5741: Docker-MCP-Server RCE Vulnerability

CVE-2026-5741 Overview

A command injection vulnerability has been identified in suvarchal docker-mcp-server up to version 0.1.0. The vulnerability exists in the stop_container, remove_container, and pull_image functions within the src/index.ts file of the HTTP Interface component. This weakness allows attackers to inject and execute arbitrary operating system commands on the target system. The vulnerability can be exploited remotely over the network without requiring authentication or user interaction.

Critical Impact

Remote attackers can execute arbitrary OS commands on systems running vulnerable versions of docker-mcp-server, potentially leading to complete system compromise, data theft, or lateral movement within containerized environments.

Affected Products

• suvarchal docker-mcp-server version 0.1.0 and earlier
• Systems exposing the docker-mcp-server HTTP Interface to network access
• Container orchestration environments utilizing the affected MCP server component

Discovery Timeline

• 2026-04-07 - CVE-2026-5741 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-5741

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), commonly known as command injection. The docker-mcp-server HTTP Interface fails to properly sanitize user-supplied input before passing it to operating system command execution functions. The affected functions stop_container(), remove_container(), and pull_image() in src/index.ts directly incorporate user-controlled parameters into shell commands without adequate validation or escaping.

When container names, image identifiers, or other parameters are processed by these functions, an attacker can craft malicious input containing shell metacharacters or command separators that break out of the intended command context. This allows execution of attacker-controlled commands with the privileges of the docker-mcp-server process.

Root Cause

The root cause of this vulnerability is improper input validation and the use of unsanitized user input in system command construction. The application directly passes user-supplied container names and image identifiers to shell execution functions without neutralizing special characters such as semicolons, backticks, pipes, or command substitution sequences. The TypeScript code in src/index.ts constructs Docker CLI commands using string concatenation or template literals that include unsanitized parameters.

Attack Vector

The attack is network-accessible, requiring no authentication or special privileges. An attacker can send crafted HTTP requests to the docker-mcp-server HTTP Interface with malicious payloads in container name or image parameters. The injection payload can include command separators (;, &&, ||) or command substitution syntax (`command` or $(command)) to append arbitrary commands to the Docker CLI invocations.

For example, when stopping a container, an attacker could supply a container name like mycontainer; malicious_command which would result in the execution of both the intended Docker command and the injected malicious command. The exploit has been publicly disclosed, and technical details are available through the GitHub Issue Report and VulDB vulnerability entry.

Detection Methods for CVE-2026-5741

Indicators of Compromise

• Unusual HTTP requests to docker-mcp-server endpoints containing shell metacharacters (;, |, &&, ||, backticks, $())
• Unexpected child processes spawned by the docker-mcp-server or Node.js runtime
• Anomalous Docker CLI command execution patterns in system logs
• Network connections or file system modifications originating from the docker-mcp-server process context

Detection Strategies

• Monitor HTTP request logs for container names or image identifiers containing command injection patterns
• Implement application-level logging to capture all parameters passed to stop_container(), remove_container(), and pull_image() functions
• Deploy network intrusion detection rules to identify command injection payloads in docker-mcp-server traffic
• Use endpoint detection and response (EDR) solutions to monitor for suspicious process execution chains

Monitoring Recommendations

• Enable verbose logging on the docker-mcp-server application to capture all incoming HTTP requests
• Configure system audit logging to track command execution by the Node.js process running docker-mcp-server
• Implement real-time alerting for detection rule matches indicating command injection attempts
• Regularly review Docker daemon logs for unexpected or malformed container operations

How to Mitigate CVE-2026-5741

Immediate Actions Required

• Restrict network access to the docker-mcp-server HTTP Interface to trusted hosts only using firewall rules or network segmentation
• Implement a web application firewall (WAF) or reverse proxy with input validation rules to filter malicious payloads
• Audit current deployments to identify exposed instances of docker-mcp-server
• Consider temporarily disabling the vulnerable HTTP Interface if it is not operationally required

Patch Information

At the time of publication, the vendor has not yet responded to the vulnerability disclosure submitted through the GitHub issue. No official patch is currently available. Organizations should monitor the project repository and security advisories for patch availability. Additional vulnerability details are tracked in VulDB Submission #786948.

Workarounds

• Deploy docker-mcp-server behind a reverse proxy that validates and sanitizes all input parameters before forwarding requests
• Use network access controls to limit exposure of the HTTP Interface to localhost or trusted internal networks only
• Implement container runtime security tools to restrict what commands can be executed within the docker-mcp-server context
• Consider using alternative Docker management solutions until an official patch is released

# Example: Restrict docker-mcp-server access using iptables
# Allow only localhost connections to the MCP server port (adjust port as needed)
iptables -A INPUT -p tcp --dport 3000 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP

# Alternative: Use firewalld to restrict access
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="127.0.0.1" port port="3000" protocol="tcp" accept'
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="3000" protocol="tcp" drop'
firewall-cmd --reload