Uncaught Exception in MCP Gateway - #VU164385
Published: November 10, 2026
Vulnerability identifier: #VU164385
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-248
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by terminating Docker MCP Gateway and disconnecting its clients.
The vulnerability exists due to an uncaught panic in the gateway's capability reload paths when unvalidated downstream resource URIs reach the MCP Go SDK's AddResource method during startup, configuration reload, or runtime capability refresh. A remote attacker can control or compromise an enabled downstream MCP server and return a resources/list response containing a malformed Resource.URI, such as %, to crash the gateway.
Affected software
MCP Gateway
Remediation
Install security update from vendor's website.
MCP Gateway - update to 0.44.1