CVE-2026-5817

🗓️ 22 May 2026 19:24:15Reported by DockerType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 64 Views🌐 WEB

Docker Model Runner on macOS loads tokenizers with trust remote code, enabling code execution from models during inference.

Reporter	Title	Published	Views	Family All 14
GithubExploit	Exploit for CVE-2026-5817	22 May 202616:30	–	githubexploit
ATTACKERKB	CVE-2026-5817	22 May 202619:24	–	attackerkb
BDU FSTEC	The vulnerability of the vllm-metal inference backend component of the Docker Desktop Docker Model Runner plugin allows a attacker to execute arbitrary code.	3 Aug 202600:00	–	bdu_fstec
Circl	CVE-2026-5817	20 May 202614:10	–	circl
CNNVD	Docker Model Runner 安全漏洞	22 May 202600:00	–	cnnvd
Cvelist	CVE-2026-5817 Docker Model Runner container-to-host code execution via unsandboxed trust_remote_code in Python inference backends	22 May 202619:24	–	cvelist
Tenable Nessus	Docker Desktop < 4.68.0 Container Escape (CVE-2026-5817)	22 May 202600:00	–	nessus
EUVD	EUVD-2026-31493	22 May 202619:24	–	euvd
Kitploit	CVE-2026-5817	31 Aug 202610:30	–	kitploit
Kitploit	CVE-2026-5817-PoC	30 Aug 202619:11	–	kitploit

NVD

Node

AND

docker docker_desktopRange4.62.0–4.68.0

apple macosMatch-

[
  {
    "vendor": "Docker",
    "product": "Docker Desktop",
    "platforms": [
      "MacOS"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "4.62.0",
        "lessThan": "4.68.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
docs	www.docs.docker.com/desktop/release-notes/

Parameter	Position	Path	Description	CWE
name	request body	model-runner.docker.internal/api/pull	Model pull endpoint accepts malicious OCI models; trainer loads tokenizers with trust_remote_code, enabling host RCE when model is loaded.	CWE-829
model	request body	model-runner.docker.internal/engines/v1/chat/completions	Inference endpoint loads the pulled model and triggers Python backend tokenizer import with trust_remote_code, enabling host RCE via malicious tokenizer code.	CWE-829
messages	request body	model-runner.docker.internal/engines/v1/chat/completions	Inference endpoint loads the pulled model and triggers Python backend tokenizer import with trust_remote_code, enabling host RCE via malicious tokenizer code.	CWE-829

23 Jul 2026 11:10Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.18.2 - 8.6

CVSS 48.8

EPSS0.00224

SSVC

CWE-829