Critical Meta-Context Injection Flaw in Docker Ask Gordon AI
Researchers discovered a critical vulnerability in Docker's Ask Gordon AI assistant that allows attackers to embed malicious instructions in Docker image metadata, which the AI fails to validate before executing. The flaw enables remote code execution in cloud environments and data exfiltration in Docker Desktop, and Docker released a patch in November 2025 after responsible disclosure.
What happened
A critical security flaw termed 'Meta-Context Injection' was discovered in Docker's Ask Gordon AI assistant, allowing attackers to embed malicious instructions in Docker image metadata labels. The AI system fails to distinguish between benign metadata and malicious commands, processing both as legitimate tasks that are forwarded to the Model Context Protocol (MCP) Gateway for execution without validation.
Reported impact
In cloud and command-line environments, the flaw enables remote code execution through multi-step command sequences embedded in image labels. In Docker Desktop environments with read-only permissions, the same technique allows data exfiltration of sensitive information including network topology, environment variables, container configurations, and enumeration of installed MCP tools and system settings.
Index analysis
The vulnerability exploits a trust failure in the AI execution chain where Docker's Ask Gordon reads and interprets metadata, forwards interpreted instructions to the MCP Gateway, and the gateway executes them through MCP tools—each stage operating without validation of the metadata source. The flaw represents a broader weakness in how AI agents interpret contextual data when embedded into development workflows.
Governance controls
Docker released a security patch in Desktop version 4.50.0 on November 6, 2025, implementing 'Human-in-the-Loop' confirmation protocols and blocking user-provided image URLs to prevent Ask Gordon from rendering unverified metadata. Noma Labs reported the issue to Docker on September 17, 2025, and Docker confirmed the vulnerability on October 13, 2025.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.