MCP server runs as privileged

ID

mcp-server-runs-as-privileged

Severity

high

Remediation Complexity

trivial

Remediation Risk

medium

Remediation Effort

low

OWASP LLM

—

OWASP ASI

ASI03:2026 (Privilege Escalation), secondary ASI05:2026

Family

ASI03 — Identity & Privilege Abuse

Red-team vectors

Privilege Escalation / Containment Failure

Tags

ai_security

Description

An MCP-server container / process manifest runs as root / privileged: no privilege-restriction declaration in its Dockerfile, docker-compose service, Kubernetes pod spec, or systemd unit. An MCP server run as root can read or write any file on the system, escalate to the host if a container breakout occurs, and inject code into peer processes — so the containment boundary around a tool-executing surface is gone.

Scoped to MCP manifests (an MCP signal in the file is required). One finding per manifest, by type:

  • Dockerfile — no USER directive, or USER root / USER 0;

  • docker-compose — no user: field;

  • Kubernetes — no securityContext.runAsNonRoot: true and no runAsUser;

  • systemd unit — no User= directive.

A USER root with a justification comment on the same line is allowed (explicit intent).

Examples

FROM ubuntu:22.04
RUN apt-get install -y mcp-server
ENTRYPOINT ["/usr/local/bin/mcp-server"]   (1)
1 No USER directive → runs as root — flagged.

A dedicated non-root user produces no finding:

RUN adduser --system mcp-user
USER mcp-user

Mitigation / Fix

  • Run the MCP server as a dedicated non-root user: USER mcp-user / compose user: / securityContext.runAsNonRoot: true (+ runAsUser) / systemd User=.

  • Drop Linux capabilities and use a read-only root filesystem where possible.