CVE-2026-5817

Docker Model Runner tokenizer trust setting enables macOS host execution

Docker · Docker Desktop for macOS / Model Runner vllm-metal backend

First documented disclosure · Review checkpoint

Summary

Model-supplied Python is executed on the host when the vulnerable tokenizer is loaded for inference.

Severity and exploitation evidence

High · 8.8/10 · CVSS 4.0. Severity source.

Exploitation not established: The original researchers describe controlled container-to-host execution. Reviewed sources do not establish malicious exploitation or confirmed victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The unsandboxed vllm-metal backend unconditionally sets trust_remote_code=True for transformers.AutoTokenizer.from_pretrained(), importing Python supplied inside an OCI model.

Conditions required

Model Runner and the affected vllm-metal backend must be enabled on macOS. Access to its API allows a container to pull an attacker-controlled model and request inference.

Potential impact

Code execution on the macOS host as the Docker Desktop user, crossing the container boundary; root privileges are not established.

Affected versions and configurations

Docker Desktop for macOS 4.62.0 through versions before 4.68.0, with the affected backend enabled.

Fix and mitigation status

Docker Desktop 4.68.0 fixes this issue; the separate MLX issue CVE-2026-5843 requires 4.71.0.

Practical next steps

Upgrade to a current supported Desktop release containing both inference-backend fixes. Until updated, disable Model Runner or avoid untrusted containers on instances where it is enabled; restrict API exposure and untrusted models.

Operating lesson

Model loading can execute code. Apply isolation and explicit trust decisions to tokenizer and backend dependencies as well as model files.

Evidence and limits

Public Docker docs PR 25107 opened May 19 and explicitly described this CVE while backfilling security notes into the earlier release. May 19 is the earliest verified public security disclosure; the April 7 fixed release is not used as the disclosure date. The researchers published May 20 and the CNA record followed May 22. The CNA also provides CVSS 3.1 8.2; this record uses its CVSS 4.0 8.8. Fixing this tokenizer path did not fix the separate MLX model_file path.

Sources