DockerDash: Two Attack Paths, One AI Supply Chain Crisis

Sasi Levi

February 3, 2026

Executive Summary

Noma Labs discloses the discovery of DockerDash. DockerDash is a critical security flaw in Docker's Ask Gordon AI (beta) assistant that exploits the entire execution chain from AI interpretation to tool execution.

In DockerDash, a single malicious metadata label in a Docker image can be used to compromise your Docker environment through a simple three-stage attack:
Gordon AI reads and interprets the malicious instruction, forwards it to the MCP Gateway, which then executes it through MCP tools. Every stage happens with zero validation, taking advantage of current agents and MCP Gateway architecture.

Noma Lab’s research uncovered a shared initial vector that led to two distinct, severe vulnerabilities in Docker, depending on the deployment environment: critical-impact Remote Code Execution (RCE) for Cloud/CLI systems and high-impact Data Exfiltration for Desktop Applications.

As your software development pipeline increasingly integrates AI assistants and agents to manage complex systems, a new, critical attack surface has emerged where contextual trust can be weaponized at multiple layers of the stack.

The breakdown happens because the
Gordon AI → MCP Gateway → MCP Tools flow treats unverified metadata as executable commands. Because this data moves through each layer without validation, an attacker can bypass security boundaries, turning a simple AI query into a direct instruction for tool execution.

The Discovery: What is Meta-Context Injection?

The core issue is a failure of contextual trust. In modern AI architectures, the Model Context Protocol (MCP) acts as a bridge between the LLM and the local environment (files, Docker containers, databases). MCPs provide the "context" AI needs to answer questions.

MCP Gateway cannot distinguish between informational metadata (like a standard Docker LABEL) and a pre-authorized, runnable internal instruction. By embedding malicious instructions in these metadata fields, an attacker can hijack the AI’s reasoning process. Noma Labs calls this technique Meta-Context Injection.

Deep Dive: Remote Code Execution via Docker CLI

Attack Vector

The RCE vulnerability exploits a critical trust boundary violation in how Ask Gordon AI processes container metadata. An attacker crafts a malicious Docker image with embedded instructions in Dockerfile LABEL fields. Instantly, metadata fields that appear innocuous but become command injection vectors when processed by Ask Gordon AI.

The Attack Chain

Stage 1: Injection

The malicious instruction is disguised as a benign image description, but it contains a multi-step command sequence that Ask Gordon AI interprets as an actionable directive.

Stage 2: Ask Gordon AI Misinterpretation

Stage 3: MCP Gateway Execution

Stage 4: MCP Tool Execution

The commands run with the victim's Docker privileges, achieving Remote Code Execution through Docker's command interface.

Deep Dive: Data Exfiltration & Reconnaissance

Attack Vector

The Data Exfiltration vulnerability exploits the same prompt-injection flaw as the RCE vulnerability but targets Docker Desktop's implementation of Ask Gordon AI. While Docker Desktop restricts Ask Gordon to read-only permissions (preventing direct command execution), this constraint doesn't prevent information disclosure. An attacker can still weaponize Ask Gordon's read access to exfiltrate sensitive internal data about the victim's environment.

The Attack Chain

Your browser does not support the video tag.

Stage 1: Injection

Stage 2: Gordon AI Misinterpretation (Desktop Context)

Stage 3: MCP Gateway with Read-Only Access

Stage 4: Data Collection via MCP Tools

Stage 5: Exfiltration
AskGordon

Key Takeaways

Why This Works

The same cascading trust failure enables this attack:

The DockerDash research reveals fundamental shifts in the AI security landscape:

Mitigation Strategy: Your Zero-Trust Imperative

The DockerDash vulnerability underscores your need to treat AI Supply Chain Risk as a current core threat. It proves that your trusted input sources can be used to hide malicious payloads that easily manipulate AI's execution path. Mitigating this new class of attacks requires implementing zero-trust validation on all contextual data provided to the AI model.

Your browser does not support the video tag.