The image wrote its own flags
Docker’s MCP Gateway let an image label write its own docker run flags
A malicious server image could ask for the host filesystem, the Docker socket and UID 0, and get them on pull.
Docker MCP Gateway from 0.21.0 to 0.42.2 read an attacker-controlled image label into its server catalogue, CVE-2026-55887 says.
The record, published 15 September, names the label, io.docker.server.metadata, and what happened next: “Volumes, User, and ExtraHosts were then appended to the docker run argument vector without an origin allowlist”. An image author could request the host filesystem or the Docker socket mounted and UID 0, and receive them “when a victim selected or pulled the image”.
It scores 8.7 out of 10 on CVSS 4.0, and the record adds that no-new-privileges does not help, “because no in-container privilege escalation is required”. The fix is 0.42.2.
It sits beside the lead because it is the same trust error one layer down: the thing you registered was allowed to describe its own permissions.
What it changes If you run Docker MCP Gateway below 0.42.2, upgrade before pulling any server image you did not build.
Primary source read
NVD record, CVE-2026-55887, Docker MCP Gateway docker/mcp-gateway v0.42.2