MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-55887 · Microsoft / collected KEV context

EUVD-2026-78684

GHSA-r2xf-7jw5-pjg6

GO-2026-5604

cve-program · CVE-2026-55887

• https://github.com/docker/mcp-gateway/security/advisories/GHSA-r2xf-7jw5-pjg6
• https://github.com/docker/mcp-gateway/pull/498
• https://github.com/docker/mcp-gateway/commit/306d2d94a3b526f43281313321bf784f2d46a7fe
• https://github.com/docker/mcp-gateway/commit/439b2200d9e26a4ff414aeb043785df45a78422b
• https://github.com/docker/mcp-gateway/releases/tag/v0.42.2

euvd · EUVD-2026-78684

• https://github.com/docker/mcp-gateway/security/advisories/GHSA-r2xf-7jw5-pjg6
• https://github.com/docker/mcp-gateway/pull/498
• https://github.com/docker/mcp-gateway/commit/306d2d94a3b526f43281313321bf784f2d46a7fe
• https://github.com/docker/mcp-gateway/commit/439b2200d9e26a4ff414aeb043785df45a78422b
• https://github.com/docker/mcp-gateway/releases/tag/v0.42.2

nvd · CVE-2026-55887

• https://github.com/docker/mcp-gateway/commit/306d2d94a3b526f43281313321bf784f2d46a7fe
• https://github.com/docker/mcp-gateway/commit/439b2200d9e26a4ff414aeb043785df45a78422b
• https://github.com/docker/mcp-gateway/pull/498
• https://github.com/docker/mcp-gateway/releases/tag/v0.42.2
• https://github.com/docker/mcp-gateway/security/advisories/GHSA-r2xf-7jw5-pjg6

osv · GHSA-r2xf-7jw5-pjg6

• https://github.com/docker/mcp-gateway/security/advisories/GHSA-r2xf-7jw5-pjg6
• https://github.com/docker/mcp-gateway

osv · GO-2026-5604

• https://github.com/docker/mcp-gateway/security/advisories/GHSA-r2xf-7jw5-pjg6

No related operational record is retained in the current change model.