CVE-2026-28400

Docker Model Runner runtime flags permit arbitrary file overwrite

Docker · Docker Model Runner / Docker Desktop

First documented disclosure · Review checkpoint

Summary

An unauthenticated configuration endpoint passes attacker-controlled flags to the inference server.

Severity and exploitation evidence

High · 7.6/10 · CVSS 3.1. Severity source.

Exploitation not established: Reviewed primary sources establish the vulnerability, but do not establish malicious exploitation or confirmed victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

POST /engines/_configure accepts arbitrary llama.cpp runtime flags; --log-file can select files writable by the Model Runner process.

Conditions required

Network access to the Model Runner API. The advisory describes default container access through model-runner.docker.internal when Model Runner is enabled; specific configurations and user interaction are required for the possible container-escape path.

Potential impact

Host-accessible files can be overwritten. Targeting Docker.raw can destroy containers, images, volumes and build history. Container escape is conditional, not an automatic consequence in every installation.

Affected versions and configurations

Docker Model Runner before 1.0.16. The CNA says Docker Desktop enabled Model Runner by default starting in 4.46.0.

Fix and mitigation status

Model Runner 1.0.16. CNA/GHSA say Desktop 4.61.0 includes it; Docker security and release documentation instead list Desktop 4.62.0.

Practical next steps

Install a current supported Desktop/Model Runner release containing the fix and verify the bundled Model Runner version. Restrict API access. Enhanced Container Isolation blocks the container access path; it does not resolve separately exposed localhost TCP access.

Operating lesson

Configuration APIs that accept process flags are privileged interfaces, even when presented as local model tooling.

Evidence and limits

February 27 is the verified public security-note PR and GHSA date; the February 12 Model Runner 1.0.16 tag and earlier Desktop release dates are not treated as disclosure. Preserve the Desktop 4.61.0 versus 4.62.0 boundary disagreement. The CNA reports CVSS 3.1 7.6, while the current GHSA displays CVSS 3.1 7.5 with the same printed vector; this record attributes 7.6 to the CNA rather than silently reconciling them. Issue-specific fixes do not establish that those old releases are safe overall.

Sources