CVE-2026-55887

Executive Summary

CVE-2026-55887 is a container-creation-time argument injection vulnerability in Docker MCP Gateway versions 0.21.0 through 0.42.1. An attacker-controlled OCI image label (io.docker.server.metadata) was YAML-unmarshalled into the broad catalog.Server structure and its runtime-shaping fields (Volumes, User, ExtraHosts) were appended to the docker run argument vector without an origin allowlist. When a victim selects or pulls the malicious image via a docker:// reference or catalog snapshot import, the attacker can force host filesystem or Docker socket mounts and UID 0 execution, yielding arbitrary code execution on the host.

Technical Analysis

The vulnerability resides in the catalog ingestion path of Docker MCP Gateway. Per the NVD description, two files are implicated: pkg/oci/self_contained.go and pkg/workingset/workingset.go. The affected data flow is:

1. An OCI image carries the label io.docker.server.metadata.
2. Between versions 0.21.0 and 0.42.1, the gateway YAML-unmarshalled this attacker-controlled label directly into the broad catalog.Server structure.
3. This occurred for both direct docker:// image references and catalog snapshot imports.
4. Runtime-shaping fields — specifically Volumes, User, and ExtraHosts — were then appended to the docker run argument vector without an origin allowlist validating that these fields came from a trusted catalog source.

The core issue is an argument injection (CWE-88) into the container runtime invocation. The attacker is not exploiting a parsing bug in Docker itself but rather the gateway's trust model: image metadata is treated as trusted catalog data with no provenance check. Because the injected fields are appended to a docker run command vector, a malicious image author can:

• Request host filesystem mounts via Volumes (e.g., mounting / or sensitive host paths into the container).
• Request Docker socket mounts, granting control over the host Docker daemon and, transitively, the host.
• Force User to UID 0, running the container as root.

Critically, the description notes this is a container-creation-time boundary bypass and is not prevented by no-new-privileges, because no in-container privilege escalation is required — the weakness manifests at container creation, before any in-container privilege controls apply. The attack requires victim interaction (selecting or pulling the image), hence the UI:R vector component.

The patch in 0.42.2 is claimed by a single source (OSV) and is not independently confirmed.

Exploitation Scenarios

No public PoC or exploit code is available for this CVE; the chain below is inferred strictly from the vulnerability class (argument injection into docker run) and the NVD description. No specific function names beyond those cited in the description are asserted.

1. Reconnaissance / Target Identification: The attacker identifies an environment running Docker MCP Gateway (versions 0.21.0–0.42.1) where a victim will select or pull MCP server images. The attack surface is the OCI image catalog, whether populated via direct docker:// references or catalog snapshot imports.

2. Triggering the Flaw Class: The attacker publishes (or compromises) an OCI image whose io.docker.server.metadata label contains YAML defining runtime-shaping fields. When the victim selects or pulls this image, the gateway unmarshals the label into the catalog.Server structure and appends the attacker-controlled Volumes, User, and ExtraHosts values to the docker run argument vector.

3. Payload / Execution Method: Because the injected fields shape container creation, the attacker sets User to 0 (root) and configures Volumes/ExtraHosts to mount host paths or the Docker socket. The resulting container executes with host-level reach — e.g., writing to mounted host paths or controlling the Docker daemon via the socket — achieving arbitrary code execution on the host. No in-container privilege escalation is needed, so no-new-privileges provides no protection.

4. Post-Exploitation Impact: Host filesystem access and/or Docker socket control enable container escape, lateral movement to other containers, credential theft from mounted host paths, and persistent code execution on the host. Because the malicious artifact is an image label, the technique blends into normal image-pull and catalog-import workflows, complicating detection.

Impact Assessment

Successful exploitation yields arbitrary code execution on the host with the confidentiality, integrity, and availability impact of the host and any co-resident containers reachable through the Docker daemon. The scope is changed (S:C in the inferred vector) because the container-creation flaw escapes the container boundary into the host. The attack is network-deliverable (AV:N), requires no privileges (PR:N), but demands victim interaction (UI:R) in the form of selecting or pulling the malicious image. Given the CVSS for this CVE is reported as N/A in the supplied data, the vector above should be treated as an analyst-estimated representation of the described impact, not an authoritative NVD score. Blast radius includes any gateway instance importing untrusted catalogs and any host whose Docker socket is mounted into affected containers. CVSS subscore reasoning: High confidentiality (host FS/socket read), High integrity (arbitrary writes/daemon control), High availability (host/container takeover).

Detection Guidance

Sigma Rule

title: Docker MCP Gateway Malicious Metadata Label Abuse (CVE-2026-55887)
id: 8f2c1a44-6b0e-4e2a-9c77-2d1f5a9e0b31
status: experimental
description: Detects docker run invocations that append runtime-shaping fields potentially injected via attacker-controlled io.docker.server.metadata OCI label.
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: 'docker'
  selection_cmd:
    CommandLine|contains|all:
      - 'run'
      - 'io.docker.server.metadata'
  selection_shaping:
    CommandLine|contains:
      - '--volume'
      - '--user 0'
      - '--user=0'
      - '--add-host'
      - 'docker.sock'
  condition: selection_img and selection_cmd and selection_shaping
fields:
  - CommandLine
  - User
  - ParentImage
falsepositives:
  - Legitimate catalogs that intentionally set volumes or user fields from trusted sources
level: high
tags:
  - attack.t1195.002
  - cve.2026.55887

YARA Rule

rule CVE_2026_55887_MCP_Gateway_Metadata
{
    meta:
        description = "Detects OCI metadata labels abusing docker run runtime-shaping fields (CVE-2026-55887)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55887"
        date = "2026-01-01"
        severity = "high"
    strings:
        $label = "io.docker.server.metadata"
        $vol = "Volumes"
        $user = "User"
        $hosts = "ExtraHosts"
        $sock = "docker.sock"
        $root_user = "User: 0"
    condition:
        $label and (2 of ($vol, $user, $hosts)) and ($sock or $root_user)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-55887 Docker MCP Gateway metadata label abuse attempt"; flow:established,to_server; content:"io.docker.server.metadata"; http_header; nocase; content:"ExtraHosts"; http_header; nocase; content:"docker.sock"; http_header; nocase; classtype:attempted-admin; sid:202655887; rev:1;)

Elastic Detection

process where process.name == "docker" and
  process.args : "run" and
  process.args : "io.docker.server.metadata" and
  (process.args : "--volume" or process.args : "--user" or process.args : "--add-host")

Splunk SPL Query

index=endpoint sourcetype=process_exec
| search process_name="docker" AND process_command_line="*run*" AND process_command_line="*io.docker.server.metadata*"
| where match(process_command_line, "--volume|--user 0|--user=0|--add-host|docker.sock")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process_command_line
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="docker,cve-2026-55887,">
  <rule id="100887" level="12">
    <decoded_as>json</decoded_as>
    <field name="process.name">docker</field>
    <field name="process.args">io.docker.server.metadata</field>
    <description>CVE-2026-55887: Possible MCP Gateway metadata label abuse in docker run invocation</description>
    <mitre>
      <id>T1195.002</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source (OSV) claims a fix in 0.42.2; not independently confirmed).

1. Immediate Mitigations:

   • Restrict catalog sources to trusted, verified publishers; disable direct docker:// reference ingestion or catalog snapshot imports from untrusted sources if feasible.
   • Do not mount the Docker socket into MCP Gateway-managed containers; enforce read-only host mounts.
   • Enforce non-root users for container execution via policy outside the gateway where possible.
   • Monitor for images carrying io.docker.server.metadata with Volumes, User, or ExtraHosts set.

2. Patch / Upgrade Steps:

   • Upgrade Docker MCP Gateway to version 0.42.2 or later, which the OSV source states fixes the issue.
   • Because patch confidence is only 2/4, independently verify the fix in pkg/oci/self_contained.go and pkg/workingset/workingset.go before relying on it.

3. Long-Term Hardening:

   • Implement an origin allowlist for runtime-shaping fields so image metadata cannot inject into docker run.
   • Adopt provenance/attestation (e.g., signed catalog entries) to validate image metadata before use.
   • Apply least-privilege to the Docker daemon and avoid exposing it to MCP-managed workloads.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-55887
• OSV package advisory (patch source): https://osv.dev/
• Docker MCP Gateway project repository (pkg/oci/self_contained.go, pkg/workingset/workingset.go)
• CWE-88: Argument Injection — https://cwe.mitre.org/data/definitions/88.html
• CISA KEV: Not listed as of report date. No threat actor campaigns or exploit-in-the-wild evidence are currently known.