CVE-2026-28400: Docker Model Runner Privilege Escalation

CVE-2026-28400 Overview

A critical arbitrary file write vulnerability exists in Docker Model Runner (DMR), software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST /engines/_configure endpoint that accepts arbitrary runtime flags without authentication. These flags are passed directly to the underlying inference server (llama.cpp), enabling attackers to inject malicious flags such as --log-file to write or overwrite arbitrary files accessible to the Model Runner process.

Critical Impact

When bundled with Docker Desktop (where Model Runner is enabled by default since version 4.46.0), attackers can target the Docker Desktop VM disk (Docker.raw), resulting in destruction of all containers, images, volumes, and build history. In specific configurations with user interaction, this vulnerability can be leveraged for container escape.

Affected Products

• Docker Model Runner versions prior to 1.0.16
• Docker Desktop versions 4.46.0 through 4.60.x (Model Runner enabled by default)
• Docker Desktop configurations exposing Model Runner API to localhost over TCP

Discovery Timeline

• 2026-02-27 - CVE CVE-2026-28400 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-28400

Vulnerability Analysis

This vulnerability stems from CWE-749: Exposed Dangerous Method or Function. The Docker Model Runner exposes an API endpoint (/engines/_configure) that allows arbitrary runtime flag injection without any authentication mechanism. The core issue is that user-supplied input is passed directly to the underlying llama.cpp inference server without proper validation or sanitization.

When Docker Model Runner is bundled with Docker Desktop, it becomes reachable from any default container at model-runner.docker.internal without authentication requirements. This accessibility significantly expands the attack surface, allowing any process running within a container to potentially exploit this vulnerability.

The most severe impact involves targeting the Docker Desktop VM disk file (Docker.raw). Successful exploitation can result in complete destruction of the Docker environment, including all containers, images, volumes, and build history. Additionally, under specific configurations and with user interaction, this vulnerability can be escalated to achieve container escape.

Root Cause

The root cause is improper exposure of dangerous functionality (CWE-749) combined with missing authentication on a sensitive API endpoint. The /engines/_configure endpoint was designed to accept runtime configuration flags but lacks input validation, allowing injection of arbitrary flags like --log-file that control file system operations. The absence of authentication means any network-accessible client can invoke this dangerous functionality.

Attack Vector

The attack requires local access to the network where Docker Model Runner is accessible. An attacker with access to a container running in Docker Desktop can reach the Model Runner API at model-runner.docker.internal. By crafting a malicious POST request to the /engines/_configure endpoint with an injected --log-file flag pointing to a critical system file, the attacker can overwrite arbitrary files within the Model Runner process's access scope.

The attack complexity is considered high due to the requirement for specific configurations or user interaction for the most severe impacts such as container escape. However, the denial of service impact through file destruction is more readily achievable.

Detection Methods for CVE-2026-28400

Indicators of Compromise

• Unexpected POST requests to /engines/_configure endpoint containing --log-file or other unusual runtime flags
• Modifications to critical Docker files such as Docker.raw or other system files
• Anomalous file write operations originating from the Model Runner process
• Network connections to model-runner.docker.internal from untrusted containers

Detection Strategies

• Monitor API access logs for the Docker Model Runner service for requests to /engines/_configure endpoint
• Implement file integrity monitoring on critical Docker Desktop files including Docker.raw
• Deploy network monitoring to detect unauthorized access attempts to Model Runner endpoints from containers
• Use behavioral analysis to identify unusual file write patterns from the Model Runner process

Monitoring Recommendations

• Enable verbose logging on Docker Model Runner API endpoints to capture all configuration requests
• Configure alerts for any modification attempts to Docker Desktop VM disk files
• Implement container network policies to restrict access to model-runner.docker.internal where not required
• Review container egress traffic for unexpected connections to internal Docker services

How to Mitigate CVE-2026-28400

Immediate Actions Required

• Update Docker Model Runner to version 1.0.16 or later immediately
• Update Docker Desktop to version 4.61.0 or later, which includes the fixed Model Runner
• Enable Enhanced Container Isolation (ECI) in Docker Desktop to block container access to Model Runner
• Audit container deployments for any that may have been compromised prior to patching

Patch Information

The vulnerability is fixed in Docker Model Runner version 1.0.16. Docker Desktop users should update to version 4.61.0 or later, which bundles the patched Model Runner component. For detailed patch information, refer to the GitHub Security Advisory and Zero Day Initiative Advisory.

Workarounds

• Enable Enhanced Container Isolation (ECI) in Docker Desktop settings to prevent container access to Model Runner
• If ECI cannot be enabled, disable Model Runner in Docker Desktop until patching is possible
• Restrict network access to the Model Runner API by implementing firewall rules
• Avoid exposing Docker Model Runner to localhost over TCP in configurations where this is optional

# Enable Enhanced Container Isolation (ECI) via Docker Desktop settings
# Navigate to: Docker Desktop > Settings > General > Enhanced Container Isolation
# Or use the CLI to verify ECI status:
docker info --format '{{.SecurityOptions}}'

# Alternatively, disable Model Runner if not required:
# Docker Desktop > Settings > Features in Development > Model Runner > Disable