feat: AVE-2026-00071 -- MCP daemon redirect (container posture) - #128
Merged
Conversation
… (container posture) Credit predictor2718's detailed cfgaudit gap breakdown on issue #68: container/daemon posture was originally a topic label covering three distinct mechanisms with no shared detection logic. Drafted only the daemon redirect (CFG082), predictor2718's own recommendation for the single highest-value record if one is drawn from that group. Explicitly excludes CFG083 (browser subprocess replacement via launcher flags), which predictor2718 initially proposed then self-corrected out: it's process-launch hijacking, only superficially resembling container posture. Also excludes CFG084 (container image trust verification disabled), a real, separate mechanism noted as a future candidate, not folded in. mitre_atlas researched and confirmed against MITRE's own ATLAS data repository: AML.T0010.001 (AI Software) explicitly names configuration files as a supply-chain target. nist_ai_rmf left as a researched empty array, no subcategory specific enough to config-driven daemon redirection found with confidence.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AVE-2026-00071: MCP daemon redirect via DOCKER_HOST/-H/--host (MEDIUM, AIVSS 5.6). First of three records drafted from predictor2718's detailed mechanism breakdown on issue #68.
Mechanism, and why exactly this one from the bucket
Container/daemon posture was originally a topic label covering three distinct mechanisms with no shared detection logic (per predictor2718's own breakdown): daemon redirect (CFG082), container image trust verification disabled (CFG084), and browser subprocess replacement (CFG083). This record covers only CFG082, predictor2718's own recommendation for the single highest-value record if one is drawn from the group: a committed
DOCKER_HOSTenv value or-H/--hostflag moves every build/run/pull onto attacker infrastructure with nothing in the compose file or image reference looking unusual.Explicitly excluded:
Framework mappings, researched not assumed
owasp_mcp: ["MCP04"](Software Supply Chain Attacks & Dependency Tampering) andowasp_asi: ["ASI04", "ASI05"](Agentic Supply Chain Vulnerabilities; Unexpected Code Execution) verified against each framework's own published category list.mitre_atlas: ["AML.T0010.001"]confirmed against MITRE's own ATLAS data repository: AI Software explicitly names configuration files as an in-scope supply-chain target.nist_ai_rmf: []: researched, no subcategory specific enough to config-driven daemon redirection found with confidence.AIVSS notes
MEDIUM despite a near-maximum
cvss_base(8.5, full daemon-compromise-equivalent impact once redirected) -- AARF's amplification profile is narrow here: single-component, no multi-agent, no natural-language surface.thm=0.90: cfgaudit actively detects this pattern in real deployed configs, but no disclosed in-the-wild campaign is cited for CFG082 specifically (unlike CFG066/CFG069/CFG005 in the same thread, which carry named CVEs).Validation
python3 scripts/validate_records.py: all 71 records valid.python3 scripts/check_fixtures.py: all 71 records have positive + negative fixtures.pytest tests/ -x -q: 284 passed.python3 scripts/validate_crosswalks.py: 4/4 crosswalks valid.node scripts/build-records.js: dist regenerated; frozen v1.1.0 snapshot untouched.Scope notes
No detection-rule PR in bawbel/scanner -- separate tracker. Two more records from the same issue #68 breakdown to follow (network posture, telemetry redirect); a fourth (sandbox-config weakening) is explicitly held per predictor2718's own two flagged reasons, not part of this pass.