Docker MCP Gateway: OCI image label controls run arguments, allowing host mounts and UID 0

Impact

For direct docker:// references and catalog snapshot imports, the gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata image label into the broad catalog.Server struct, then appended runtime-shaping fields - Volumes, User, ExtraHosts - to the docker run argument vector with no origin allowlist. A malicious image author can therefore have the victim's own gateway mount the host filesystem or the Docker socket and run the container as UID 0. Because the boundary is crossed at container-creation time rather than inside the container, no-new-privileges does not help: no in-container escalation is needed. Where MCP gateways run on shared agent hosts pulling third-party server images, one attractive image is enough to get code execution as the daemon's host user and, via the socket, control of every container on the box.

Who can reach it

A local Docker MCP Gateway user who selects or pulls a malicious image, or imports a catalog snapshot referencing one. No credentials needed by the attacker; the victim's act of pulling or running the image is the trigger.

What to do

Upgrade Docker MCP Gateway to 0.42.2, which applies an origin allowlist to the label-derived runtime fields, and restart the gateway process. No node reboot. Until then, run only images from catalogs you control, avoid importing untrusted catalog snapshots, and do not run the gateway on a host where the Docker socket grants more than you are willing to lose.

References

Related entries

• Firecracker: Out-of-bounds write in the virtio PCI transportCVE-2026-5747 · FirecrackerHigh
• Red Hat ACM lighthouse: unvalidated EndpointSlice IPs let a spoke cluster hijack cross-cluster service trafficCVE-2026-66787 · Red Hat Advanced Cluster Management lighthouse (cross-cluster service DNS)High
• NGINX Ingress Controller: unsanitized Ingress annotations inject arbitrary NGINX directivesCVE-2026-77180 · NGINX Ingress Controller (Ingress annotation to nginx.conf generator)High
• Nuclio dashboard: namespace headers reach /bin/sh unquoted on the list-all path, unauthenticated RCECVE-2026-79756 · Nuclio dashboard (local/Docker platform, list-all resource path)High
• Coolify: shell metacharacters in env var keys give command execution on managed server hostsCVE-2026-84694 · Coolify (environment variable key names in Docker commands run over SSH)High
• runc: Host runc binary overwritten from inside a containerCVE-2019-5736 · runcHigh