CVE-2026-55887

Name of the Vulnerable Software and Affected Versions Docker MCP Plugin (affected versions not specified)

Description A flaw in the OCI image label parsing allows an attacker to inject arbitrary arguments into the docker run command line. This occurs because the io.docker.server.metadata label is unmarshalled directly into the catalog.Server struct, allowing mass-assignment of runtime-shaping fields such as Volumes, User, Command, ExtraHosts, AllowHosts, DisableNetwork, Env, Remote, SSEEndpoint, OAuth, Secrets, LongLived, and Policy. The gateway then appends these fields as flags (e.g., -v, -u, --add-host) without validation. An attacker controlling an image referenced via docker:// or a catalog snapshot can use this to mount the host filesystem, run as UID 0, and execute arbitrary code on the host, bypassing the container/host trust boundary.

Recommendations Update the software to the version where the OCI image-label parser is restricted to populating only descriptive fields, excluding those that control the container runtime.