{"items":[{"id":"NVI-00018453","kind":"vulnerability","title":"Docker MCP Gateway: Argument injection via OCI image label YAML","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-r2xf-7jw5-pjg6","CVE-2026-55887"],"plain_summary":"GitHub lists this reviewed advisory for github.com/docker/mcp-gateway. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-26c0ebb4dad40c4eb44dc722a4ee90ce"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-26c0ebb4dad40c4eb44dc722a4ee90ce","url":"https://github.com/advisories/GHSA-r2xf-7jw5-pjg6","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-r2xf-7jw5-pjg6","publisher":"GitHub Advisory Database","observed_at":"2026-11-06T07:20:20.042Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-26c0ebb4dad40c4eb44dc722a4ee90ce"],"technology":"github.com/docker/mcp-gateway","known_exclusions":[],"conditions_summary":"## Summary\n\nA maliciously crafted OCI image label can inject arbitrary arguments into the `docker run` command line constructed by the MCP Gateway. An attacker who controls an image that the victim references via `docker://`, or that the victim's catalog pulls a snapshot from, can mount the host filesystem, run as UID 0, and execute arbitrary code on the host.\n  \n## Details\n\n The `io.docker.server.metadata` OCI image label is YAML-unmarshalled directly into the wide `catalog.Server` struct, which carries runtime-shaping fields (`Volumes`, `User`, `Command`, `ExtraHosts`, `AllowHosts`, `DisableNetwork`, `Env`, `Remote`, `SSEEndpoint`, `OAuth`,`Secrets`, `LongLived`, `Policy`) alongside descriptive fields. Every runtime field carries a YAML tag, so the unmarshal mass-assigns from the attacker-controlled label content; only `Image` is overwritten afterwards. The gateway's container-launch code then appends those fields verbatim as `docker run` flags (`-v`, `-u`, `--add-host`) with no allowlist or origin check, and execs `docker` with the resulting argv.\n\n## Impact\n  \nA malicious image author can achieve arbitrary code execution as UID 0 on the host of a victim running an affected vers","public_affected_ranges":[">= 0.21.0, < 0.42.2"]}],"null_published_at":"2026-11-07T07:07:39.838Z","source_updated_at":"2026-06-18T13:05:08.000Z","source_disclosed_at":"2026-06-18T13:05:06.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-06T07:20:20.042Z"}],"next_cursor":null,"snapshot_revision":"42594"}