Docker MCP Gateway versions 0.14.0 through versions earlier than 0.44.1 accepted downstream capability metadata without first validating it through the MCP SDK. A malicious or compromised server already enabled in the gateway could return a resource whose URI did not parse, such as a bare percent sign. Registration through the SDK's AddResource method could…
Inspect the ClaimsCase · DiggingBeagle record
Malformed enabled-server metadata can crash Docker MCP Gateway
An already enabled downstream MCP server could crash affected Docker MCP Gateway versions by supplying a malformed resource URI. Version 0.44.1 adds isolated validation and panic recovery. The documented effect is availability loss, not established credential theft.
Scope
Controlled finding or reported disclosure as of 2026-10-08; Requires control of an already enabled server; availability issue, not established credential theft.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Desk review of scoped canonical Claims, the pinned SRC-2026-CP3-MCP-GATEWAY-URI Source, and the publicly accessible primary disclosure. The classification applies to the documented setting and prerequisites only. Impact remains unbanded because real victim consequences are not established, and no independent reproduction is claimed. Details: No confirmed exploitation campaign or duration of real production outages is publicly established.
Assessed Oct 13, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP3-MCP-GATEWAY-URI-1 · CLM-CP3-MCP-GATEWAY-URI-2 · CLM-CP3-MCP-GATEWAY-URI-3 · Docker MCP Gateway crashes on malformed downstream resource URI
At a glance
Treat MCP capability metadata as untrusted input even when it comes from an installed server. Registration should be isolated and validated before it mutates the live routing state; a malformed single capability should not kill the gateway.
Read the implicationsNo confirmed exploitation campaign or duration of real production outages is publicly established.
Limits and uncertaintyFull account
Docker MCP Gateway versions 0.14.0 through versions earlier than 0.44.1 accepted downstream capability metadata without first validating it through the MCP SDK. A malicious or compromised server already enabled in the gateway could return a resource whose URI did not parse, such as a bare percent sign. Registration through the SDK's AddResource method could panic and terminate the gateway, disconnecting clients. A remote client with no control over any enabled downstream server cannot trigger this route merely by connecting.
The vulnerable transfer occurred on both initial configuration reload and incremental capability refresh. Docker's 0.44.1 fix validates tools, prompts, resources and templates against an isolated SDK instance, recovers validation panics and omits only the malformed capability. Disabling an untrusted downstream server can remove the trigger, but it is not a general fix for an enabled hostile server on affected versions. The published impact is service availability; the advisory does not establish credential theft or content manipulation.
Mechanism and trust boundary
- 01
Enabled server prerequisite
The attacker controls or compromises an already enabled downstream MCP server.
Boundary: The attacker controls or compromises an already enabled downstream MCP server.
- 02
Capability discovery
A resources/list response contains a malformed Resource.URI that reaches gateway registration.
Boundary: A resources/list response contains a malformed Resource.URI that reaches gateway registration.
- 03
Gateway availability
AddResource panics during initial or incremental reload and can terminate the gateway, disconnecting downstream clients.
Boundary: AddResource panics during initial or incremental reload and can terminate the gateway, disconnecting downstream clients.
Timeline
- Oct 8, 2026disclosure
Public disclosure
Claims & evidence
CLM-CP3-MCP-GATEWAY-URI-1Docker reports that versions 0.14.0 through versions before 0.44.1 can terminate when an enabled downstream MCP server returns malformed resources/list URI metadata.supported
Basis: reported finding
- supportsDocker MCP Gateway crashes on malformed downstream resource URIprimary disclosure
Description, Summary and Details
CLM-CP3-MCP-GATEWAY-URI-2Docker identifies version 0.44.1 as the fix and states that no confidentiality or integrity impact was identified.supported
Basis: reported finding
- supportsDocker MCP Gateway crashes on malformed downstream resource URIprimary disclosure
Affected versions, Patched versions and Impact
CLM-CP3-MCP-GATEWAY-URI-3The 0.44.1 patch validates downstream capabilities through an isolated SDK server, recovers parser panics and omits a malformed capability rather than terminating the active gateway.supported
Basis: reported finding
- supportsDocker MCP Gateway crashes on malformed downstream resource URIprimary disclosure
GHSA-jfp6-4vv7-6m6c, Patches
Implications
Treat MCP capability metadata as untrusted input even when it comes from an installed server. Registration should be isolated and validated before it mutates the live routing state; a malformed single capability should not kill the gateway.
Controls and mitigations
- Upgrade Docker MCP Gateway to 0.44.1 or later, where isolated SDK validation and panic recovery are documented.
- Remove or disable a remotely controlled downstream server if it blocks startup before upgrading.
- Test both configuration reload and per-server capability refresh; validation only on the initial path would miss an exposure.
Unknowns and contradictions
- No confirmed exploitation campaign or duration of real production outages is publicly established.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 137