PT-2026-42830 · Docker · Docker Model Runner

David Rochester + 1 · Published 2026-05-22 · Updated 2026-05-25 · CVE-2026-5817

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Docker Model Runner on macOS (affected versions not specified)

Description The vllm-metal inference backend unconditionally sets trust remote code=True when loading model tokenizers and operates without sandboxing. This allows the transformers.AutoTokenizer.from pretrained() function to import and execute arbitrary Python files contained within any model retrieved from an OCI registry. Consequently, this leads to arbitrary code execution on the Docker host with the privileges of the Docker Desktop user when inference is triggered. Any container on the Docker network can initiate this process by calling the 'model-runner.docker.internal' API to pull a malicious model and request inference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2026-5817

Affected Products

Docker Model Runner

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-5817 · Security Note
• https://t.me/CVEtracker/54665 · Telegram Post
• https://twitter.com/CVEnew/status/2058155790410961023 · Twitter Post
• https://twitter.com/infoflowcloud/status/2058156305756442769 · Twitter Post
• https://docs.docker.com/desktop/release-notes/#4680 · Note
• https://pbxscience.com/security-advisory-cve-2026-5817-docker-model-runner-arbitrary-code-execution-via-unsandboxed-trust_remote_code-tokenizer-loading · Reddit Post