# CVE-2026-55887: Docker MCP Gateway argument injection via OCI image label

Source: https://junglewise.ai/threats/cve-2026-55887-docker-mcp-gateway-argument-injection-via-oci-image-label  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-06-18  
License: CC BY 4.0 with a link back

CVE-2026-55887 · Severity: high · CVSS 4 · Published 2026-09-15

Docker MCP Gateway is a tool used to manage Model Context Protocol (MCP) servers. A vulnerability allows a malicious OCI image to inject unauthorized commands when the gateway starts a container. This could allow an attacker to gain full control over the host computer, including the ability to access all files and run programs with administrative privileges.

Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-55887 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55887 being exploited in the wild.

**How severe is CVE-2026-55887?** High severity, with a CVSS score of 4, published 15 September 2026.

**Which products and versions are affected?** github.com/docker/mcp-gateway (Go) >= 0.21.0, < 0.42.2, SEMVER:introduced=0.21.0,fixed=0.42.2.

**Is there a fix for CVE-2026-55887?** Yes. github.com/docker/mcp-gateway (Go): upgrade to 0.42.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55887 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-55887?** Check whether you run github.com/docker/mcp-gateway (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/docker/mcp-gateway (Go): upgrade to 0.42.2 or later

  ```sh
  go get github.com/docker/mcp-gateway@v0.42.2
  ```


## Technical details

An argument injection vulnerability exists in Docker MCP Gateway due to improper handling of OCI image labels. The 'io.docker.server.metadata' label is unmarshalled directly into a struct containing runtime-shaping fields like Volumes and User. Because these fields are then appended verbatim as flags to a 'docker run' command without validation, an attacker-controlled image can specify flags such as '-v /:/host' or '-u root'. This allows for a complete container escape and arbitrary code execution as root on the host system. The issue is fixed in version 0.42.2 by restricting the parser to only populate descriptive fields.

## Affected products

- Docker mcp-gateway >= 0.21.0, < 0.42.2

## Identifiers

- CVE-2026-55887
- GHSA-r2xf-7jw5-pjg6
- GO-2026-5604

## Timeline

- 2026-06-16: disclosed
- 2026-06-18: advisory
- 2026-06-18: patched: Fixed in version 0.42.2

## References

- [https://github.com/docker/mcp-gateway/security/advisories/GHSA-r2xf-7jw5-pjg6](https://github.com/docker/mcp-gateway/security/advisories/GHSA-r2xf-7jw5-pjg6)
- [https://api.github.com/repos/docker/mcp-gateway/security-advisories/GHSA-r2xf-7jw5-pjg6](https://api.github.com/repos/docker/mcp-gateway/security-advisories/GHSA-r2xf-7jw5-pjg6)

## Related threats

- [Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode](https://junglewise.ai/threats/cve-2025-64443-docker-mcp-plugin-and-docker-mcp-gateway-have-dns-rebinding)