CVE-2026-5843— Docker Model Runner container-to-host code execution via MLX-LM model_file importlib loading
Possible ATT&CK Techniques 3AI
T1105 · Ingress Tool Transfer T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Docker | Docker Desktop | 4.56.0< 4.71.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-5843
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Docker Model Runner container-to-host code execution via MLX-LM model_file importlib loading
Source: NVD (National Vulnerability Database)
Vulnerability Description
The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model directories via the model_file configuration field in config.json. When a model's config.json specifies a model_file pointing to a Python file, MLX-LM uses importlib to load and execute it with no trust_remote_code gate or equivalent safety check. The MLX backend runs without sandboxing, resulting in arbitrary code execution on the Docker host as the Docker Desktop user. Any container on the Docker network can trigger this by calling the model-runner.docker.internal API to pull a malicious model from an attacker-controlled OCI registry and request inference.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
从非可信控制范围包含功能例程
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Docker | Docker Desktop | 4.56.0 ~ 4.71.0 | - |
II. Public POCs for CVE-2026-5843
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-5843
请登录查看更多情报信息。
Same Patch Batch · Docker · 2026-05-22 · 3 CVEs total
| CVE-2026-6406 | 8.8 HIGH | Docker Desktop Enhanced Container Isolation bypass via --use-api-socket CLI flag |
| CVE-2026-5817 | 8.2 HIGH | Docker Model Runner container-to-host code execution via unsandboxed trust_remote_code in |
IV. Related Vulnerabilities
Same product: Docker Desktop
- CVE-2026-5817
Docker Model Runner container-to-host code execution via uns - CVE-2026-6406
Docker Desktop Enhanced Container Isolation bypass via --use - CVE-2026-2664
Out of bounds read vulnerability in grpcfuse kernel module - CVE-2025-14740
Docker Desktop for Windows Incorrect Permission Assignment P - CVE-2025-13743
Expired Personal Access Tokens (PATs) are recorded in Docker
Same vendor: Docker
- CVE-2026-5817
Docker Model Runner container-to-host code execution via uns - CVE-2026-6406
Docker Desktop Enhanced Container Isolation bypass via --use - CVE-2026-33990
Docker Model Runner OCI Registry Client Vulnerable to Server - CVE-2025-15558
Docker Desktop Docker Plugins Uncontrolled Search Path Eleme - CVE-2026-28400
Docker Model Runner Unauthenticated Runtime Flag Injection v
Same weakness: CWE-829
- CVE-2026-5817
Docker Model Runner container-to-host code execution via uns - CVE-2026-7373
Metasploit Pro on Windows: Local Privilege Escalation via Op - CVE-2026-44312
css_parser allows to MITM included https css urls - CVE-2026-44995
OpenClaw < 2026.4.20 - Arbitrary Code Execution via MCP stdi - CVE-2026-45184
Kdenlive 安全漏洞
V. Comments for CVE-2026-5843
No comments yet