CVE-2026-5741 suvarchal CVE debrief

Who should care

Users of suvarchal docker-mcp-server up to 0.1.0 should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes applying the patch or update to the latest version of suvarchal docker-mcp-server, restricting access to the HTTP Interface, monitoring for suspicious activity, implementing compensating controls, and verifying the integrity of the system.

Technical summary

The vulnerability is caused by a weakness in the stop_container/remove_container/pull_image function of the src/index.ts file in the HTTP Interface of suvarchal docker-mcp-server up to 0.1.0. This weakness allows for os command injection, which can be exploited remotely. The exploit has been made public and can be used for attacks. Users of suvarchal docker-mcp-server up to 0.1.0 should be aware of this vulnerability and take necessary actions to mitigate the risk.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it has a CVSS score of 5.5 and can be exploited remotely.

Recommended defensive actions

• Apply the patch or update to the latest version of suvarchal docker-mcp-server
• Restrict access to the HTTP Interface
• Monitor for suspicious activity
• Implement compensating controls
• Verify the integrity of the system
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-07T20:16:34.873Z and was last modified on 2026-07-24T09:10:00.153Z. The NVD entry is currently Deferred. The vulnerability affects suvarchal docker-mcp-server up to 0.1.0, and the impacted element is the function stop_container/remove_container/pull_image of the file src/index.ts of the component HTTP Interface. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Official resources