mcp-docker-tools arbitrary code execution via handleImageList

CVE-2026-106765 (published 2026-10-23, NVD Deferred) is an arbitrary code execution issue in the mcp-docker-tools MCP server, reachable through the handleImageList function when processing attacker-controlled image-list arguments.

Because Docker MCP servers run near root and manage containers, an agent-triggered command injection here can pivot from a prompt to host/container compromise. Low blast radius due to narrow deployment, but a clear instance of the agentic-tool command-injection class.

A crafted image/filter argument to the handleImageList function is incorporated into a shell invocation without escaping, allowing an agent-driven request to execute arbitrary code on the Docker host (which often has privileged/root access).

@rog0x/mcp-docker-tools 1.0.1

No fixed release documented (NVD Deferred). If deployed, avoid exposing the Docker MCP server to untrusted agent prompts and run it under a restricted (non-root) service account/container.