# CVE-2026-55887: MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway

> CVE-2026-55887: MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway. CVSS 8.7 (CVSS 4.0).

Canonical: https://rewindex.com/cve/CVE-2026-55887
Last updated: 2026-09-30T17:51:56Z

- Published: 2026-09-15 15:45 UTC · Updated: 2026-09-30 17:51 UTC · Assigner: GitHub\_M
- CVSS: 8.7 (CVSS 4.0) · Severity: High
- EPSS: 0.22%, 13th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-88

## Description

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot imports in pkg/oci/self\_contained.go and pkg/workingset/workingset.go. Runtime-shaping fields including Volumes, User, and ExtraHosts were then appended to the docker run argument vector without an origin allowlist, allowing a malicious image author to request host filesystem or Docker socket mounts and UID 0 execution when a victim selected or pulled the image. This container-creation-time boundary bypass can execute arbitrary code on the host and is not prevented by no-new-privileges because no in-container privilege escalation is required. This issue is fixed in version 0.42.2.

## Affected vendors and products

- docker: mcp-gateway

## Tracked companies

- [Docker](https://rewindex.com/company/docker.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-55887)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-55887)
- [https://github.com/docker/mcp-gateway/commit/306d2d94a3b526f43281313321bf784f2d46a7fe](https://github.com/docker/mcp-gateway/commit/306d2d94a3b526f43281313321bf784f2d46a7fe)
- [https://github.com/docker/mcp-gateway/commit/439b2200d9e26a4ff414aeb043785df45a78422b](https://github.com/docker/mcp-gateway/commit/439b2200d9e26a4ff414aeb043785df45a78422b)
- [https://github.com/docker/mcp-gateway/pull/498](https://github.com/docker/mcp-gateway/pull/498)
- [https://github.com/docker/mcp-gateway/releases/tag/v0.42.2](https://github.com/docker/mcp-gateway/releases/tag/v0.42.2)
- [https://github.com/docker/mcp-gateway/security/advisories/GHSA-r2xf-7jw5-pjg6](https://github.com/docker/mcp-gateway/security/advisories/GHSA-r2xf-7jw5-pjg6)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-55887 · Markdown: https://rewindex.com/cve/CVE-2026-55887.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-55887 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:16:35.004Z