CVE-2026-33990: Docker Model Runner SSRF Vulnerability

CVE-2026-33990 Overview

Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. A Server-Side Request Forgery (SSRF) vulnerability exists in the OCI registry token exchange flow in versions prior to 1.1.25. When pulling a model, Model Runner follows the realm URL from the registry's WWW-Authenticate header without validating the scheme, hostname, or IP range. This allows a malicious OCI registry to set the realm to an internal URL (e.g., http://127.0.0.1:3000/), causing Model Runner running on the host to make arbitrary GET requests to internal services and reflect the full response body back to the caller.

Critical Impact

A malicious OCI registry can exploit this vulnerability to access internal services, exfiltrate sensitive data, and relay information back to an attacker-controlled registry via the Authorization: Bearer header token exchange mechanism.

Affected Products

• Docker Model Runner versions prior to 1.1.25
• Docker Desktop with Model Runner exposed to localhost over TCP
• Systems running Docker Model Runner without Enhanced Container Isolation (ECI)

Discovery Timeline

• 2026-04-01 - CVE CVE-2026-33990 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-33990

Vulnerability Analysis

This Server-Side Request Forgery (SSRF) vulnerability (CWE-918) resides in Docker Model Runner's OCI registry authentication flow. The vulnerability occurs when Model Runner processes the WWW-Authenticate header response from an OCI registry during the token exchange process for pulling AI models.

The core issue is insufficient validation of the realm URL parameter within the WWW-Authenticate header. When a user attempts to pull a model from a registry, the Model Runner initiates an authentication flow that relies on realm URLs provided by the registry itself. The application fails to validate whether the realm URL points to a legitimate external authentication service or to an internal network resource.

Root Cause

The root cause is improper input validation of the realm URL extracted from the WWW-Authenticate header during OCI registry authentication. The Model Runner trusts the registry-provided realm URL without implementing necessary security controls such as scheme validation (blocking non-HTTPS schemes), hostname allowlisting, or IP range restrictions that would prevent requests to internal network addresses like 127.0.0.1, 10.x.x.x, 192.168.x.x, or other RFC 1918 private addresses.

Attack Vector

An attacker can exploit this vulnerability by setting up a malicious OCI registry that returns a crafted WWW-Authenticate header with a realm URL pointing to internal services. The attack flow proceeds as follows:

1. The attacker hosts a malicious OCI registry accessible to the victim
2. The victim's Docker Model Runner attempts to pull a model from the malicious registry
3. The malicious registry responds with a WWW-Authenticate header containing an internal URL as the realm (e.g., http://127.0.0.1:3000/internal-api)
4. Model Runner follows the realm URL and makes a GET request to the internal service
5. The response from the internal service is reflected back to the attacker
6. Additionally, the token exchange mechanism can be abused to relay data from internal services to the attacker via the Authorization: Bearer header

This attack enables reconnaissance of internal network services, exfiltration of sensitive data from internal endpoints, and potential pivoting to further compromise internal infrastructure. For technical details about this vulnerability, see the GitHub Security Advisory.

Detection Methods for CVE-2026-33990

Indicators of Compromise

• Unexpected outbound requests from Docker Model Runner to internal IP addresses (127.0.0.1, 10.x.x.x, 192.168.x.x, 172.16.x.x-172.31.x.x)
• Model Runner processes making HTTP requests to non-standard ports on localhost
• Unusual WWW-Authenticate headers in OCI registry responses containing internal URLs
• Authentication token exchanges with unexpected realm endpoints

Detection Strategies

• Monitor network traffic from Docker Model Runner processes for connections to internal IP ranges or localhost
• Implement network segmentation alerts for cross-zone traffic originating from container management services
• Review Docker Model Runner logs for authentication flows involving suspicious realm URLs
• Deploy intrusion detection rules to flag WWW-Authenticate headers containing RFC 1918 addresses or localhost references

Monitoring Recommendations

• Enable verbose logging for Docker Model Runner authentication events
• Configure alerts for Model Runner network connections to internal services that should not be accessed during normal operations
• Monitor for data exfiltration patterns where internal service responses may be relayed through outbound connections
• Implement DNS query monitoring to detect resolution of internal hostnames by the Model Runner service

How to Mitigate CVE-2026-33990

Immediate Actions Required

• Upgrade Docker Model Runner to version 1.1.25 or later immediately
• Enable Enhanced Container Isolation (ECI) in Docker Desktop to block container access to Model Runner
• Restrict Model Runner's network access to only necessary external registries using firewall rules
• Audit current model sources and remove any untrusted or unknown registries

Patch Information

Docker has released version 1.1.25 of Model Runner which addresses this SSRF vulnerability. Users should upgrade to this version or later to receive the security fix. For Docker Desktop users, enabling Enhanced Container Isolation (ECI) provides an additional layer of protection by blocking container access to Model Runner. However, if the Docker Model Runner is exposed to localhost over TCP in specific configurations, the vulnerability may still be exploitable even with ECI enabled. For complete details, refer to the GitHub Security Advisory.

Workarounds

• Enable Enhanced Container Isolation (ECI) in Docker Desktop settings to prevent containers from accessing Model Runner
• Avoid exposing Docker Model Runner to localhost over TCP unless absolutely necessary
• Implement network-level controls to restrict Model Runner from accessing internal services
• Only pull models from trusted, verified OCI registries

# Configuration example
# Enable Enhanced Container Isolation in Docker Desktop
# Navigate to Docker Desktop > Settings > Resources > Advanced
# Enable "Enhanced Container Isolation"

# If using Docker Model Runner on command line, restrict network access
# using firewall rules (example using iptables on Linux):
iptables -A OUTPUT -m owner --uid-owner docker-model-runner -d 127.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner docker-model-runner -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner docker-model-runner -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner docker-model-runner -d 192.168.0.0/16 -j DROP