CVE-2026-28400: Docker Model Runner Privilege Escalation

CVE-2026-28400 Overview

A critical arbitrary file write vulnerability exists in Docker Model Runner (DMR), software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST /engines/_configure endpoint that accepts arbitrary runtime flags without authentication. These flags are passed directly to the underlying inference server (llama.cpp), enabling attackers to inject malicious flags such as --log-file to write or overwrite arbitrary files accessible to the Model Runner process.

Critical Impact
When bundled with Docker Desktop (where Model Runner is enabled by default since version 4.46.0), attackers can target the Docker Desktop VM disk (Docker.raw), resulting in destruction of all containers, images, volumes, and build history. In specific configurations with user interaction, this vulnerability can be leveraged for container escape.

Affected Products

Docker Model Runner versions prior to 1.0.16
Docker Desktop versions 4.46.0 through 4.60.x (Model Runner enabled by default)
Docker Desktop configurations exposing Model Runner API to localhost over TCP

Discovery Timeline

2026-02-27 - CVE CVE-2026-28400 published to NVD
2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-28400

Vulnerability Analysis

This vulnerability stems from CWE-749: Exposed Dangerous Method or Function. The Docker Model Runner exposes an API endpoint (/engines/_configure) that allows arbitrary runtime flag injection without any authentication mechanism. The core issue is that user-supplied input is passed directly to the underlying llama.cpp inference server without proper validation or sanitization.

When Docker Model Runner is bundled with Docker Desktop, it becomes reachable from any default container at model-runner.docker.internal without authentication requirements. This accessibility significantly expands the attack surface, allowing any process running within a container to potentially exploit this vulnerability.

The most severe impact involves targeting the Docker Desktop VM disk file (Docker.raw). Successful exploitation can result in complete destruction of the Docker environment, including all containers, images, volumes, and build history. Additionally, under specific configurations and with user interaction, this vulnerability can be escalated to achieve container escape.

Root Cause

The root cause is improper exposure of dangerous functionality (CWE-749) combined with missing authentication on a sensitive API endpoint. The /engines/_configure endpoint was designed to accept runtime configuration flags but lacks input validation, allowing injection of arbitrary flags like --log-file that control file system operations. The absence of authentication means any network-accessible client can invoke this dangerous functionality.

Attack Vector

The attack requires local access to the network where Docker Model Runner is accessible. An attacker with access to a container running in Docker Desktop can reach the Model Runner API at model-runner.docker.internal. By crafting a malicious POST request to the /engines/_configure endpoint with an injected --log-file flag pointing to a critical system file, the attacker can overwrite arbitrary files within the Model Runner process's access scope.

The attack complexity is considered high due to the requirement for specific configurations or user interaction for the most severe impacts such as container escape. However, the denial of service impact through file destruction is more readily achievable.

Detection Methods for CVE-2026-28400

Indicators of Compromise

Unexpected POST requests to /engines/_configure endpoint containing --log-file or other unusual runtime flags
Modifications to critical Docker files such as Docker.raw or other system files
Anomalous file write operations originating from the Model Runner process
Network connections to model-runner.docker.internal from untrusted containers

Detection Strategies

Monitor API access logs for the Docker Model Runner service for requests to /engines/_configure endpoint
Implement file integrity monitoring on critical Docker Desktop files including Docker.raw
Deploy network monitoring to detect unauthorized access attempts to Model Runner endpoints from containers
Use behavioral analysis to identify unusual file write patterns from the Model Runner process

Monitoring Recommendations

Enable verbose logging on Docker Model Runner API endpoints to capture all configuration requests
Configure alerts for any modification attempts to Docker Desktop VM disk files
Implement container network policies to restrict access to model-runner.docker.internal where not required
Review container egress traffic for unexpected connections to internal Docker services

How to Mitigate CVE-2026-28400

Immediate Actions Required

Update Docker Model Runner to version 1.0.16 or later immediately
Update Docker Desktop to version 4.61.0 or later, which includes the fixed Model Runner
Enable Enhanced Container Isolation (ECI) in Docker Desktop to block container access to Model Runner
Audit container deployments for any that may have been compromised prior to patching

Patch Information

The vulnerability is fixed in Docker Model Runner version 1.0.16. Docker Desktop users should update to version 4.61.0 or later, which bundles the patched Model Runner component. For detailed patch information, refer to the GitHub Security Advisory and Zero Day Initiative Advisory.

Workarounds

Enable Enhanced Container Isolation (ECI) in Docker Desktop settings to prevent container access to Model Runner
If ECI cannot be enabled, disable Model Runner in Docker Desktop until patching is possible
Restrict network access to the Model Runner API by implementing firewall rules
Avoid exposing Docker Model Runner to localhost over TCP in configurations where this is optional

bash

# Enable Enhanced Container Isolation (ECI) via Docker Desktop settings
# Navigate to: Docker Desktop > Settings > General > Enhanced Container Isolation
# Or use the CLI to verify ECI status:
docker info --format '{{.SecurityOptions}}'

# Alternatively, disable Model Runner if not required:
# Docker Desktop > Settings > Features in Development > Model Runner > Disable