CVE-2026-33990

Docker Model Runner token exchange can reach and leak internal services

Docker · Docker Model Runner OCI registry client

First documented disclosure · Review checkpoint

Summary

An attacker-controlled model registry can redirect token requests to internal services and return their data.

Severity and exploitation evidence

Medium · 6.8/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed advisory and public fix establish an SSRF weakness; they do not establish malicious exploitation or confirmed victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The registry WWW-Authenticate realm URL is followed without scheme, host or IP validation. Internal response bodies can be reflected to the caller or relayed to the registry in Authorization: Bearer.

Conditions required

A malicious OCI registry must be used for a model pull. An attacker can trigger that through accessible Model Runner API access, or a user can pull the attacker-controlled model.

Potential impact

Server-side GET requests from the host to internal services and disclosure of their response data. Arbitrary host code execution is not established by this advisory.

Affected versions and configurations

Docker Model Runner before 1.1.25.

Fix and mitigation status

Model Runner 1.1.25; Docker Desktop 4.67.0 includes the fix.

Practical next steps

Upgrade to a supported release containing the fix. Restrict model registries and Model Runner API exposure. Enhanced Container Isolation blocks the container access path, but the advisory retains a caveat for localhost TCP exposure.

Operating lesson

Treat registry authentication challenges as untrusted redirects, and validate their destinations before making host-network requests.

Evidence and limits

The public security-specific PR opened and merged March 24, before the March 30 GHSA and April 1 CNA record; March 24 is therefore used for disclosure. Model Runner 1.1.25 shipped March 24 and Desktop 4.67.0 on March 30. The CNA scores 6.8 Medium under CVSS 4.0 (local, low privileges, no interaction); the current GHSA scores 7.1 High under CVSS 4.0 (network, no privileges, passive interaction). These are source-specific assumptions, not interchangeable scores.

Sources