Docker MCP Server OS Command Injection (CVE-2026-5741)
Date: 2026-04
Affected: Docker MCP Server OS Command Injection (CVE-2026-5741)
Attack vector: prompt-injection
Category: real-world
Severity: Medium
CVE: CVE-2026-5741

OS command injection in suvarchal docker-mcp-server (up to 0.1.0) via `stop_container`/`remove_container`/`pull_image` functions. Public exploit available. Unpatched (vendor unresponsive). CVSS 4.0 score: 6.9.


Mitigations:

Architectural layers (MAESTRO):