CVE-2026-33990
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Docker Model Runner prior to version 1.1.25 contains an SSRF vulnerability in the OCI registry token exchange flow where Model Runner follows the realm URL from the WWW-Authenticate header without validating scheme, hostname, or IP range. A malicious OCI registry can set the realm to an internal URL, causing requests to internal services and reflecting responses. The issue is patched in version 1.1.25.
Risk Assessment
An attacker can use Model Runner to make requests to internal services and exfiltrate data via the Authorization header. This may lead to information disclosure from the internal network.
Recommendation
Upgrade Docker Model Runner to version 1.1.25. Docker Desktop users should enable Enhanced Container Isolation (ECI) to block container access to Model Runner.
Other vulnerabilities in Docker Model Runner
See all- CVE-2026-5843High
The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model directories via the model_file configuration field in config.json. No sandboxing allows remote code execution on the Docker host as the Docker Desktop user.
- CVE-2026-5817High
The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers and runs without sandboxing. This causes arbitrary Python file execution from the model, enabling remote code execution on the Docker host as the Docker Desktop user.
Original NVD description (English source)
Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Prior to version 1.1.25, Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange flow. When pulling a model, Model Runner follows the realm URL from the registry's WWW-Authenticate header without validating the scheme, hostname, or IP range. A malicious OCI registry can set the realm to an internal URL (e.g., http://127.0.0.1:3000/), causing Model Runner running on the host to make arbitrary GET requests to internal services and reflect the full response body back to the caller. Additionally, the token exchange mechanism can relay data from internal services back to the attacker-controlled registry via the Authorization: Bearer header. This issue has been patched in version 1.1.25. For Docker Desktop users, enabling Enhanced Container Isolation (ECI) blocks container access to Model Runner, preventing exploitation. However, if the Docker Model Runner is exposed to localhost over TCP in specific configurations, the vulnerability is still exploitable.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS