PT-2026-31014 · Suvarchal · Docker-Mcp-Server

Brucejin · Published 2026-04-07 · Updated 2026-04-08 · CVE-2026-5741

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions suvarchal docker-mcp-server versions up to 0.1.0

Description A weakness exists in the stop container/remove container/pull image function within the src/index.ts file of the HTTP Interface component. This can lead to operating system command injection, potentially allowing remote execution of commands. The exploit has been publicly released.

Recommendations Update to a version beyond 0.1.0. As a temporary workaround, restrict access to the HTTP Interface component or disable the stop container(), remove container(), and pull image() functions until a patch is available.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-5741

Affected Products

Docker-Mcp-Server

References · 8

• 🔥 https://github.com/BruceJqs/public_exp/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5741 · Security Note
• https://github.com/suvarchal/docker-mcp/issues/3 · Note
• https://vuldb.com/submit/786948 · Note
• https://vuldb.com/vuln/355748/cti · Note
• https://twitter.com/VulmonFeeds/status/2041757806265508283 · Twitter Post
• https://twitter.com/CVEnew/status/2041711884878147975 · Twitter Post
• https://vuldb.com/vuln/355748 · Note