CVE-2026-116102

QuantGeekDev docker-mcp Windows deployment command injection

QuantGeekDev · docker-mcp

First documented disclosure · Review checkpoint

Summary

A crafted Compose project name can inject host commands through the Windows deployment path of this independent MCP server.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: Real-world malicious exploitation is not established by the reviewed primary sources; a vulnerability report or public demonstration is not evidence of a victim incident.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The Windows command builder interpolates project_name into a shell string without sufficient neutralization.

Conditions required

Windows host running an affected docker-mcp release; attacker-controlled project_name must reach the deploy-compose tool. The CNA score includes user interaction.

Potential impact

Commands can run with the MCP server process privileges, affecting host confidentiality, integrity and availability.

Affected versions and configurations

0.1.0 and 0.2.0.

Fix and mitigation status

Unknown; no corrected release is identified in the reviewed CNA/advisory.

Practical next steps

Pending a verified fix, avoid the affected Windows deployment path for untrusted input and restrict the MCP process privileges. Maintainers should use argument arrays and validate project names.

Operating lesson

An AI tool parameter must stay data when it crosses into an operating-system command.

Evidence and limits

VulDB documents public disclosure on October 25; the CVE record followed October 26. September 26 is a submission date, not verified public disclosure. This is QuantGeekDev docker-mcp, not a Docker Inc. product.

Sources