What happened
Docker MCP Gateway trusts image-supplied metadata labels enough to unmarshal them into its internal server-catalog data structure, letting a malicious or compromised container image inject unintended catalog configuration when referenced directly or imported via a snapshot.
Why it matters
MCP Gateway is used to run and manage MCP servers at scale; allowing an untrusted container image to influence the gateway's own catalog configuration is a supply-chain-adjacent risk that could let a malicious image redefine how other MCP servers are exposed or configured within the same gateway.
Attack vector
The gateway YAML-unmarshals the attacker-controlled io.docker.server.metadata OCI image label directly into the broad catalog.Server structure whenever a direct docker:// reference or catalog snapshot is imported, without restricting which fields a malicious image can set.
Affected systems
Docker MCP Gateway, versions 0.21.0 through 0.42.2
Mitigation
Upgrade to the patched Docker MCP Gateway release referenced in the fix commit. Restrict which registries/images can be referenced via docker:// or imported into the catalog to trusted sources.