{"id":"CVE-2026-116102","kind":"vulnerability","aliases":["CVE-2026-116102"],"related":[],"title":"docker-mcp: project_name argument enables remote OS command injection","description":"A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function _build_windows_command of the file docker_executor.py. This manipulation of the argument project_name causes os command injection. It is possible to initiate the attack remotely.","summary":"The docker-mcp MCP server builds a Windows command in _build_windows_command from the project_name argument without sanitizing it. A remote attacker who controls that argument can inject operating system commands that run on the host.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","docker-mcp","mcp","python","self-hosted","windows"],"not_affected_if":["no-remote-callers","not-windows","other-versions"],"how_to_check":"- Check the installed version: `pip show docker-mcp` or inspect the package lockfile for `docker-mcp` at `0.1.0` or `0.2.0`\n- Search the code for `_build_windows_command` in `docker_executor.py`\n- unknown whether other checks are needed","fix":"- Move off `docker-mcp` `0.1.0` and `0.2.0` to a fixed release; unknown which version fixes it\n- Until patched, stop exposing the MCP server to untrusted callers\n- unknown whether a vendor fix exists","status":"open","published_at":"2026-10-26T01:17:15+00:00","first_seen_at":"2026-10-26T01:38:48+00:00","triaged_at":"2026-10-26T01:40:53+00:00","updated_at":"2026-10-26T01:40:53+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-26T01:40:53Z","model":"claude-haiku-5-5","output":{"fix":"- Move off `docker-mcp` `0.1.0` and `0.2.0` to a fixed release; unknown which version fixes it\n- Until patched, stop exposing the MCP server to untrusted callers\n- unknown whether a vendor fix exists","reach":"internet","title":"docker-mcp: project_name argument enables remote OS command injection","impact":"high","summary":"The docker-mcp MCP server builds a Windows command in _build_windows_command from the project_name argument without sanitizing it. A remote attacker who controls that argument can inject operating system commands that run on the host.","category":"ai-tooling","nicknames":[],"who_cares":["docker-mcp","mcp","python","windows","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary operating system commands on the host.","analyst_note":"Check the NVD entry and the upstream QuantGeekDev/docker-mcp repository for a fixed version and whether the flaw is reachable over the network transport.","how_to_check":"- Check the installed version: `pip show docker-mcp` or inspect the package lockfile for `docker-mcp` at `0.1.0` or `0.2.0`\n- Search the code for `_build_windows_command` in `docker_executor.py`\n- unknown whether other checks are needed","needs_analyst":true,"not_affected_if":["other-versions","not-windows","no-remote-callers"],"who_is_affected":"Teams that run the docker-mcp server from QuantGeekDev, versions 0.1.0 and 0.2.0, on Windows where the project_name argument can be supplied by a remote caller. Installations that do not run the server, or that run it only with trusted local input, are less exposed. The sources do not say which deployment modes are reachable from the internet.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000659,"input_tokens":3312,"output_tokens":655,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116102':14A,17A '-2026':13A,16A '/0.2.0':79C '0.1.0':78C 'ai':19B 'ai-tool':18B 'argument':6A,48B,58B,97C 'attack':54B,110C 'build':36B,41B,86C 'caus':100C 'command':10A,39B,43B,63B,88C,102C 'control':56B 'cve':12A,15A 'determin':72C 'docker':2A,22B,32B,76C 'docker-mcp':1A,21B,31B,75C 'docker_executor.py':92C 'element':82C 'enabl':7A 'file':91C 'function':85C 'host':28B,68B 'impact':81C 'initi':108C 'inject':11A,60B,103C 'manipul':94C 'mcp':3A,23B,24B,33B,34B,77C 'name':5A,47B,99C 'oper':61B 'os':9A,101C 'possibl':106C 'project':4A,46B,98C 'python':25B 'quantgeekdev':74C 'remot':8A,53B,111C 'run':65B 'sanit':50B 'self':27B 'self-host':26B 'server':35B 'system':62B 'tool':20B 'vulner':70C 'window':29B,38B,42B,87C 'without':49B","nicknames":[],"mitigations":[],"who_affected":"Teams that run the docker-mcp server from QuantGeekDev, versions 0.1.0 and 0.2.0, on Windows where the project_name argument can be supplied by a remote caller. Installations that do not run the server, or that run it only with trusted local input, are less exposed. The sources do not say which deployment modes are reachable from the internet.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T01:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116102","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116102","severity":null,"published_at":"2026-10-26T01:17:15+00:00","modified_at":"2026-10-26T01:17:15+00:00","first_seen_at":"2026-10-26T01:38:48+00:00","fetched_at":"2026-10-26T01:38:48+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}