{"id":"CVE-2026-55887","title":"MCP Gateway allows easy and secure running and deployment of MCP servers","summary":"MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server stru…","severity":"high","cvss":8.7,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":["CWE-88"],"vendor":"docker","product":"mcp-gateway","affected":["mcp-gateway >= 0.21.0, < 0.42.2"],"patched":["github.com/docker/mcp-gateway 0.42.2"],"published":"2026-09-15","updated":"2026-09-15","sourceUpdated":"2026-09-15T19:17:23.150","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55887","references":[{"url":"https://github.com/docker/mcp-gateway/commit/306d2d94a3b526f43281313321bf784f2d46a7fe","label":"security-advisories@github.com"},{"url":"https://github.com/docker/mcp-gateway/commit/439b2200d9e26a4ff414aeb043785df45a78422b","label":"security-advisories@github.com"},{"url":"https://github.com/docker/mcp-gateway/pull/498","label":"security-advisories@github.com"},{"url":"https://github.com/docker/mcp-gateway/releases/tag/v0.42.2","label":"security-advisories@github.com"},{"url":"https://github.com/docker/mcp-gateway/security/advisories/GHSA-r2xf-7jw5-pjg6","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-r2xf-7jw5-pjg6"}],"tags":["nvd","cve.org","ghsa","go"],"ecosystem":"go","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-15T17:45:43.530044Z"},"cvssSource":"cna","ingestedAt":"2026-06-29T14:31:47.009Z","epss":0.00199,"epssPercentile":0.09983,"slug":"CVE-2026-55887","body":"## Overview\n\nMCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot imports in pkg/oci/self_contained.go and pkg/workingset/workingset.go. Runtime-shaping fields including Volumes, User, and ExtraHosts were then appended to the docker run argument vector without an origin allowlist, allowing a malicious image author to request host filesystem or Docker socket mounts and UID 0 execution when a victim selected or pulled the image. This container-creation-time boundary bypass can execute arbitrary code on the host and is not prevented by no-new-privileges because no in-container privilege escalation is required. This issue is fixed in version 0.42.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55887)\n\nAffected packages:\n\n- `github.com/docker/mcp-gateway >= 0.21.0, < 0.42.2`\n\nPatched in:\n\n- `github.com/docker/mcp-gateway 0.42.2`\n\nSource: https://github.com/advisories/GHSA-r2xf-7jw5-pjg6","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":204270,"id":"CVE-2026-55887","ts":1789490437903,"field":"cvss","old":null,"new":"8.7"}]}