MCP Gateway for Docker reads OCI image labels and incorporates them into the server configuration without an allowlist. This flaw caused fields such as Volumes, User, and ExtraHosts to be appended directly to the docker run command vector. An attacker controlling the image label could therefore request the host filesystem or Docker socket to be mounted, and the container could run as UID 0. This bypass of the container‑creation boundary enables the attacker to execute arbitrary code on the host, equivalent to host‑level compromise. The flaw is not mitigated by the no‑new‑privileges setting because no in‑container privilege escalation is necessary; the escape occurs during container launch.

All users running Docker MCP Gateway version 0.21.0 through 0.42.1 are affected. The vulnerability was fixed in release 0.42.2, so any instance using the earlier range without the patch is vulnerable.

With a CVSS score of 8.7 the vulnerability is considered high severity. The EPSS score is currently unavailable, but the lack of an official KEV listing does not mitigate the risk; the flaw remains exploitable via a malicious OCI image pull can achieve host‑level code execution by supplying an image with crafted labels; no special privileges or additional network access are required beyond the ability to pull the image.