Executive brief
Docker MCP Gateway is a tool used to manage Model Context Protocol (MCP) servers. A vulnerability allows a malicious OCI image to inject unauthorized commands when the gateway starts a container. This could allow an attacker to gain full control over the host computer, including the ability to access all files and run programs with administrative privileges.
Technical details
An argument injection vulnerability exists in Docker MCP Gateway due to improper handling of OCI image labels. The 'io.docker.server.metadata' label is unmarshalled directly into a struct containing runtime-shaping fields like Volumes and User. Because these fields are then appended verbatim as flags to a 'docker run' command without validation, an attacker-controlled image can specify flags such as '-v /:/host' or '-u root'. This allows for a complete container escape and arbitrary code execution as root on the host system. The issue is fixed in version 0.42.2 by restricting the parser to only populate descriptive fields.
Affected products
- Docker mcp-gateway >= 0.21.0, < 0.42.2
Timeline
- 2026-06-16: disclosed
- 2026-06-18: advisory
- 2026-06-18: patched: Fixed in version 0.42.2