Docker
CVE-2026-28400
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess Model Runner POST /engines/_configure endpoint
-
ExploitInject --log-file flag in request
-
ExecutionPass arbitrary runtime flags to llama.cpp
-
ImpactWrite arbitrary files to filesystem
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Dangerous method exposure prevention
|
| Exploitation Conditions | Docker Model Runner versions prior to 1.0.16 with unauthenticated POST /engines/_configure endpoint exposed; Docker Desktop 4.46.0 or later with Model Runner enabled by default; local network access to Model Runner API; attacker with local user privileges and ability to interact with GUI |
| Impact | CVSS 7.5 (HIGH). Attack vector: Local. Complexity: High. Privileges required: Low. User interaction: Required. Exploitation no authentication required. Exploitable via remote/network. |
| Exploit ScenarioDerived | A remote attacker without authentication could exploit this flaw, the destruction of all containers, images, volumes, and buil. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
and deploy AI models using Docker. versions up to 1.0.16 contains a security vulnerability (CVSS 7.5).
RemediationAI
Update to version 4.61.0 or later.
Affected ProductsAI
Product: and deploy AI models using Docker.. Versions: up to 1.0.16.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
affects and deploy AI models using Docker.. Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST /engines/_configure endpoint that accepts arbitrary runtime flags without authentication. These flags are passed directly to the underlying inference server (llama.cpp). By injecting the --log-file flag, an attacker with network access to the Model Runner API can write or overwrite arbitrary files accessible to the Model Runner process. When bundled with Dock
Know when Docker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST /engines/_configure endpoint that accepts arbitrary runtime flags without authentication. These flags are passed directly to the underlying inference server (llama.cpp). By injecting the --log-file flag, an attacker with network access to the Model Runner API can write or overwrite arbitrary files accessible to the Model Runner process. When bundled with Docker Desktop (where Model Runner is enabled by default since version 4.46.0), it is reachable from any default container at model-runner.docker.internal without authentication. In this context, the file overwrite can target the Docker Desktop VM disk (Docker.raw ), resulting in the destruction of all containers, images, volumes, and build history. However, in specific configurations and with user interaction, it is possible to convert this vulnerability in a container escape. The issue is fixed in Docker Model Runner 1.0.16. Docker Desktop users should update to 4.61.0 or later, which includes the fixed Model Runner. A workaround is available. For Docker Desktop users, enabling Enhanced Container Isolation (ECI) blocks container access to Model Runner, preventing exploitation. However, if the Docker Model Runner is exposed to localhost over TCP in specific configurations, the vulnerability is still exploitable.
Zero Day Initiative Advisories
Executive ViewAI
A high-severity vulnerability (CVSS 7.5) affects AI model deployment systems using Docker versions up to 1.0.16, with no patch currently available. Organizations using this software for containerized AI operations face potential unauthorized access or system compromise, requiring immediate interim protective measures.
Implement network segmentation isolating Docker deployment infrastructure; restrict administrative access via firewall rules and VPN; disable unnecessary API endpoints; enforce strict container image verification and signing; implement runtime behavioral monitoring for anomalous container activity; apply principle of least privilege for service accounts; monitor vendor advisories for patch release; consider temporary rollback to earlier unaffected versions if operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Unauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Exploit-DB