CVE-2026-33990

Deeper analysis

Docker Model Runner (DMR), a software component for managing, running, and deploying AI models using Docker, contains a Server-Side Request Forgery (SSRF) vulnerability, identified as CVE-2026-33990, in versions prior to 1.1.25. The flaw resides in the OCI registry token exchange flow, where DMR blindly follows the realm URL specified in the registry's WWW-Authenticate header without validating the scheme, hostname, or IP range. This allows a malicious registry to redirect requests to arbitrary internal endpoints.

Attackers can exploit this vulnerability remotely with no privileges or user interaction required, as indicated by its CVSS score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). By controlling an OCI registry and tricking a victim into pulling a model from it, an attacker can force the Model Runner on the host to issue arbitrary GET requests to internal services, such as http://127.0.0.1:3000/. The full response body from these internal services is reflected back to the attacker, enabling reconnaissance. Additionally, the token exchange process can relay data from internal services to the attacker-controlled registry via the Authorization: Bearer header, potentially compromising sensitive information and enabling further integrity violations.

The GitHub security advisory (GHSA-x2f5-332j-9xwq) confirms the issue has been patched in Docker Model Runner version 1.1.25. For Docker Desktop users, enabling Enhanced Container Isolation (ECI) prevents container access to Model Runner, mitigating exploitation. However, in configurations where Model Runner is exposed to localhost over TCP, the vulnerability remains exploitable even with these measures.

This vulnerability is particularly relevant in AI/ML workflows, as DMR is designed specifically for handling AI model deployments via Docker, potentially exposing internal infrastructure in machine learning pipelines to external threats. No real-world exploitation has been reported in the provided details.