Docker MCP Gateway tool-name case mismatch allowed reserved-tool impersonation

Docker MCP Gateway exposed a namespace identity mismatch. At registration, one reserved-tool collision check compared names using case-sensitive strings; elsewhere, enablement logic treated the relevant tool name without identical case restrictions. An attacker-controlled MCP server that had already been installed and enabled could publish an altered-case version of a gateway-owned tool name without being rejected by the first check.

The resulting danger was ambiguous dispatch. When a client selected the impostor, arguments intended for a privileged gateway operation could be routed to the attacker's server. No such diversion was guaranteed merely because a malicious tool was registered: server enablement and actual client selection are essential prerequisites. The advisory reports versions 0.43.1 through 0.43.3 as affected and 0.44.1 as fixed through consistent case handling and stricter allowlisting.

This vulnerability should not be merged with the older malformed-enabled-server metadata crash. The earlier issue concerned availability after bad metadata; the case-variant collision concerns which identity receives a tool call. A meaningful verification test must register a harmless colliding tool in the vulnerable release, trace the actual dispatched recipient and repeat against the patched release. A model refusal that arrives after arguments reached an impostor would not repair the authorization failure.