CVE-2026-5843

Docker Model Runner MLX model configuration enables macOS host execution

Docker · Docker Desktop for macOS / Model Runner MLX backend

First documented disclosure · Review checkpoint

Summary

An OCI model can direct the MLX backend to import attacker-supplied Python on the host.

Severity and exploitation evidence

High · 8.8/10 · CVSS 4.0. Severity source.

Exploitation not established: The original researchers describe controlled container-to-host execution through this separate model_file path. Reviewed sources do not establish malicious exploitation or confirmed victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

MLX-LM uses a model_file field in config.json with importlib, without a trust_remote_code gate or equivalent check; the affected Python backend runs without sandboxing.

Conditions required

Model Runner and the MLX backend must be enabled on macOS. A container or another caller with API access must pull the malicious model and trigger inference.

Potential impact

Code execution on the macOS host as the Docker Desktop user, crossing the container boundary; root privileges are not established.

Affected versions and configurations

Docker Desktop for macOS 4.56.0 through versions before 4.71.0, with the affected backend enabled.

Fix and mitigation status

Docker Desktop 4.71.0, released April 27.

Practical next steps

Upgrade to a current supported Desktop release containing the fix. Until updated, disable Model Runner or avoid untrusted containers on instances where it is enabled; restrict API exposure and untrusted models.

Operating lesson

Fix each executable model-loading path; removing one trust flag does not secure a different import mechanism.

Evidence and limits

Docker docs PR 25107 publicly named and described this CVE on May 19 and explicitly backfilled release notes. The April 27 release is the fix date, not verified public disclosure. Original research followed May 20 and CNA publication May 22. The CNA also provides CVSS 3.1 8.2; this record uses its CVSS 4.0 8.8. This is a separate weakness from CVE-2026-5817 and remains affected after the earlier 4.68.0 fix. Version boundaries are issue-specific, not a general endorsement of old releases.

Sources