CVE-2026-28400

Deeper analysis

Docker Model Runner (DMR), a software component for managing, running, and deploying AI models using Docker, contains a vulnerability in versions prior to 1.0.16. The issue stems from an exposed POST /engines/_configure endpoint that accepts arbitrary runtime flags without authentication; these flags are passed directly to the underlying inference server (llama.cpp). An attacker can inject the --log-file flag to write or overwrite arbitrary files accessible to the Model Runner process. This affects DMR standalone and is particularly impactful when bundled with Docker Desktop versions 4.46.0 and later, where Model Runner is enabled by default.

Attackers with network access to the Model Runner API can exploit this vulnerability. In Docker Desktop environments, the endpoint is reachable without authentication from any default container via model-runner.docker.internal, allowing file overwrites including the Docker Desktop VM disk (Docker.raw), which destroys all containers, images, volumes, and build history. In specific configurations combined with user interaction, exploitation can lead to container escape. The CVSS score is 7.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H), associated with CWE-749.

Advisories recommend updating to Docker Model Runner 1.0.16 or Docker Desktop 4.61.0 or later, which include the fixed Model Runner. A workaround for Docker Desktop users is to enable Enhanced Container Isolation (ECI), which blocks container access to Model Runner and prevents exploitation. However, if Model Runner is exposed to localhost over TCP in certain configurations, the vulnerability remains exploitable. Details are available in the GitHub Security Advisory (GHSA-m456-c56c-hh5c) and Zero Day Initiative advisory (ZDI-CAN-28379).

This vulnerability has relevance to AI/ML deployments, as it targets a tool specifically designed for running inference servers like llama.cpp within containerized environments. No public reports of real-world exploitation are noted.