CriticalSupply chainBLWK-AI-019

An MCP server runs a privileged or host-mounting container

What this means

An MCP server running a privileged or host-mounting container (--privileged, -v /var/run/docker.sock, -v /:…).

How to fix it

Remove --privileged, the Docker socket mount (-v /var/run/docker.sock), and any root-filesystem bind mount (-v /:…) from this MCP server's docker command. Each one hands the container — and thus anything the agent can drive through it — full control of the host.

Check it yourself

Run a scan and look for BLWK-AI-019 in the results:

bulwark scan
bulwark ai scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

References

• MITRE ATT&CK T1610
• MITRE ATT&CK T1611

Related checks

• A Python startup hook runs code in every Python process · BLWK-PERSIST-005
• Traces of the LiteLLM 1.107.0 credential stealer were found · BLWK-ROOTKIT-002
• An MCP server runs an unpinned package from a registry · BLWK-AI-003
• An MCP server uses mcp-remote (critical command-injection ≤ 0.1.15) · BLWK-AI-004
• An MCP server launches via a shell interpreter · BLWK-AI-005