---
id: CVE-2026-55887
title: MCP Gateway allows easy and secure running and deployment of MCP servers
summary: >-
  MCP Gateway allows easy and secure running and deployment of MCP servers. From
  0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the
  attacker-controlled io.docker.server.metadata OCI image label into the broad
  catalog.Server stru…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'
cwe:
  - CWE-88
vendor: docker
product: mcp-gateway
affected:
  - 'mcp-gateway >= 0.21.0, < 0.42.2'
patched:
  - github.com/docker/mcp-gateway 0.42.2
published: '2026-09-15'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T19:17:23.150'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55887'
references:
  - url: >-
      https://github.com/docker/mcp-gateway/commit/306d2d94a3b526f43281313321bf784f2d46a7fe
    label: security-advisories@github.com
  - url: >-
      https://github.com/docker/mcp-gateway/commit/439b2200d9e26a4ff414aeb043785df45a78422b
    label: security-advisories@github.com
  - url: 'https://github.com/docker/mcp-gateway/pull/498'
    label: security-advisories@github.com
  - url: 'https://github.com/docker/mcp-gateway/releases/tag/v0.42.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/docker/mcp-gateway/security/advisories/GHSA-r2xf-7jw5-pjg6
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-r2xf-7jw5-pjg6'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-15T17:45:43.530044Z'
cvssSource: cna
ingestedAt: '2026-06-29T14:31:47.009Z'
epss: 0.00222
epssPercentile: 0.11456
---

## Overview

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot imports in pkg/oci/self_contained.go and pkg/workingset/workingset.go. Runtime-shaping fields including Volumes, User, and ExtraHosts were then appended to the docker run argument vector without an origin allowlist, allowing a malicious image author to request host filesystem or Docker socket mounts and UID 0 execution when a victim selected or pulled the image. This container-creation-time boundary bypass can execute arbitrary code on the host and is not prevented by no-new-privileges because no in-container privilege escalation is required. This issue is fixed in version 0.42.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55887)

Affected packages:

- `github.com/docker/mcp-gateway >= 0.21.0, < 0.42.2`

Patched in:

- `github.com/docker/mcp-gateway 0.42.2`

Source: https://github.com/advisories/GHSA-r2xf-7jw5-pjg6