Vibe Coding
Docker MCP Gateway let a malicious image's OCI label request host mounts and UID 0
CVE-2026-55887, published 2026-09-15 at 8.7 HIGH, covers MCP Gateway from 0.21.0 until 0.42.2. It YAML-unmarshalled the attacker-controlled `io.docker.server.metadata` OCI image label into the broad `catalog.Server` struct for direct `docker://` references and catalog snapshot imports, then appended runtime-shaping fields including `Volumes`, `User` and `ExtraHosts` to the `docker run` argument vector with no origin allowlist. Selecting or pulling a malicious image was enough to get host filesystem or Docker socket mounts and root execution.
Source
↳ Follow the thread