CVE-2026-5817— Docker Model Runner container-to-host code execution via unsandboxed trust_remote_code in Python inference backends
Possible ATT&CK Techniques 3AI
T1090 · Proxy T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Docker | Docker Desktop | 4.62.0< 4.68.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-5817
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Docker Model Runner container-to-host code execution via unsandboxed trust_remote_code in Python inference backends
Source: NVD (National Vulnerability Database)
Vulnerability Description
The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without sandboxing. This causes transformers.AutoTokenizer.from_pretrained() to import and execute arbitrary Python files included in any model pulled from an OCI registry, resulting in arbitrary code execution on the Docker host as the Docker Desktop user when inference is triggered. Any container on the Docker network can trigger this by calling the model-runner.docker.internal API to pull a malicious model and request inference.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
从非可信控制范围包含功能例程
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Docker | Docker Desktop | 4.62.0 ~ 4.68.0 | - |
II. Public POCs for CVE-2026-5817
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-5817
请登录查看更多情报信息。
Same Patch Batch · Docker · 2026-05-22 · 3 CVEs total
| CVE-2026-6406 | 8.8 HIGH | Docker Desktop Enhanced Container Isolation bypass via --use-api-socket CLI flag |
| CVE-2026-5843 | 8.2 HIGH | Docker Model Runner container-to-host code execution via MLX-LM model_file importlib loadi |
IV. Related Vulnerabilities
Same product: Docker Desktop
- CVE-2026-5843
Docker Model Runner container-to-host code execution via MLX - CVE-2026-6406
Docker Desktop Enhanced Container Isolation bypass via --use - CVE-2026-2664
Out of bounds read vulnerability in grpcfuse kernel module - CVE-2025-14740
Docker Desktop for Windows Incorrect Permission Assignment P - CVE-2025-13743
Expired Personal Access Tokens (PATs) are recorded in Docker
Same vendor: Docker
- CVE-2026-5843
Docker Model Runner container-to-host code execution via MLX - CVE-2026-6406
Docker Desktop Enhanced Container Isolation bypass via --use - CVE-2026-33990
Docker Model Runner OCI Registry Client Vulnerable to Server - CVE-2025-15558
Docker Desktop Docker Plugins Uncontrolled Search Path Eleme - CVE-2026-28400
Docker Model Runner Unauthenticated Runtime Flag Injection v
Same weakness: CWE-829
- CVE-2026-5843
Docker Model Runner container-to-host code execution via MLX - CVE-2026-7373
Metasploit Pro on Windows: Local Privilege Escalation via Op - CVE-2026-44312
css_parser allows to MITM included https css urls - CVE-2026-44995
OpenClaw < 2026.4.20 - Arbitrary Code Execution via MCP stdi - CVE-2026-45184
Kdenlive 安全漏洞
V. Comments for CVE-2026-5817
No comments yet