CVE-2026-55887

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot imports in pkg/oci/self_contained.go and pkg/workingset/workingset.go. Runtime-shaping fields including Volumes, User, and ExtraHosts were then appended to the docker run argument vector without an origin allowlist, allowing a malicious image author to request host filesystem or Docker socket mounts and UID 0 execution when a victim selected or pulled the image. This container-creation-time boundary bypass can execute arbitrary code on the host and is not prevented by no-new-privileges because no in-container privilege escalation is required. This issue is fixed in version 0.42.2.

• CWE-88

• https://github.com/docker/mcp-gateway/commit/306d2d94a3b526f43281313321bf784f2d46a7fe
• https://github.com/docker/mcp-gateway/commit/439b2200d9e26a4ff414aeb043785df45a78422b
• https://github.com/docker/mcp-gateway/pull/498
• https://github.com/docker/mcp-gateway/releases/tag/v0.42.2
• https://github.com/docker/mcp-gateway/security/advisories/GHSA-r2xf-7jw5-pjg6

Published

Sep 15, 2026

Last Modified

Sep 15, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55881OpenReplay is a self-hosted session replay suite. From 1.22.…7.1
• CVE-2026-55882Tilt defines dev environments as code for microservice apps …8.3
• CVE-2026-55883Tilt defines dev environments as code for microservice apps …8.3
• CVE-2026-55884Tilt defines dev environments as code for microservice apps …9.2
• CVE-2026-55885Grav is a file-based Web platform. Prior to 1.7.53, an authe…6.8
• CVE-2026-55886Jodit Editor is a WYSIWYG editor with written in pure TypeSc…6.3
• CVE-2026-5589An integer underflow in bt_mesh_sol_recv() in the Bluetooth …6.3
• CVE-2026-55890Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav…4.8
• CVE-2026-55891PrivateBin is an online pastebin where the server has zero k…0
• CVE-2026-55892Vim is an open source, command line text editor. Prior to 9.…5.5
• CVE-2026-55893Capstone is a disassembly framework. In 6.0.0-Alpha9 and ear…7.3
• CVE-2026-55894Capstone is a disassembly framework. In 6.0.0-Alpha9 and ear…6.8