Docker MCP Gateway ran host mounts and UID 0 from an image label.

CVE-2026-55887 at 8.7, affecting 0.21.0 through 0.42.2, YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI label into the broad catalog.Server struct, then appended Volumes, User and ExtraHosts to the docker run argument vector with no origin allowlist. Selecting or pulling a malicious image got you host filesystem or Docker socket mounts and root execution. The category lesson: a registry label is attacker input, and unmarshalling it into your config struct hands the attacker your config.