CVE-2026-33990

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33990", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-24T22:20:06.211Z", "datePublished": "2026-04-01T16:17:40.719Z", "dateUpdated": "2026-04-04T03:02:31.956Z"}, "containers": {"cna": {"title": "Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/docker/model-runner/security/advisories/GHSA-x2f5-332j-9xwq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/docker/model-runner/security/advisories/GHSA-x2f5-332j-9xwq"}], "affected": [{"vendor": "docker", "product": "model-runner", "versions": [{"version": "< 1.1.25", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-01T16:17:40.719Z"}, "descriptions": [{"lang": "en", "value": "Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Prior to version 1.1.25, Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange flow. When pulling a model, Model Runner follows the realm URL from the registry's WWW-Authenticate header without validating the scheme, hostname, or IP range. A malicious OCI registry can set the realm to an internal URL (e.g., http://127.0.0.1:3000/), causing Model Runner running on the host to make arbitrary GET requests to internal services and reflect the full response body back to the caller. Additionally, the token exchange mechanism can relay data from internal services back to the attacker-controlled registry via the Authorization: Bearer header. This issue has been patched in version 1.1.25. For Docker Desktop users, enabling Enhanced Container Isolation (ECI) blocks container access to Model Runner, preventing exploitation. However, if the Docker Model Runner is exposed to localhost over TCP in specific configurations, the vulnerability is still exploitable."}], "source": {"advisory": "GHSA-x2f5-332j-9xwq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-04T03:01:15.736753Z", "id": "CVE-2026-33990", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-04T03:02:31.956Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-33990", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-04T03:01:15.736753Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-04T03:02:04.767Z"}}], "cna": {"title": "Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)", "source": {"advisory": "GHSA-x2f5-332j-9xwq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "docker", "product": "model-runner", "versions": [{"status": "affected", "version": "< 1.1.25"}]}], "references": [{"url": "https://github.com/docker/model-runner/security/advisories/GHSA-x2f5-332j-9xwq", "name": "https://github.com/docker/model-runner/security/advisories/GHSA-x2f5-332j-9xwq", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Prior to version 1.1.25, Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange flow. When pulling a model, Model Runner follows the realm URL from the registry's WWW-Authenticate header without validating the scheme, hostname, or IP range. A malicious OCI registry can set the realm to an internal URL (e.g., http://127.0.0.1:3000/), causing Model Runner running on the host to make arbitrary GET requests to internal services and reflect the full response body back to the caller. Additionally, the token exchange mechanism can relay data from internal services back to the attacker-controlled registry via the Authorization: Bearer header. This issue has been patched in version 1.1.25. For Docker Desktop users, enabling Enhanced Container Isolation (ECI) blocks container access to Model Runner, preventing exploitation. However, if the Docker Model Runner is exposed to localhost over TCP in specific configurations, the vulnerability is still exploitable."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-01T16:17:40.719Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33990", "state": "PUBLISHED", "dateUpdated": "2026-04-04T03:02:31.956Z", "dateReserved": "2026-03-24T22:20:06.211Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-01T16:17:40.719Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "model-runner", "vendor": "docker", "versions": [{"status": "affected", "version": "< 1.1.25"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:docker:model_runner:*:*:*:*:*:docker:*:*", "matchCriteriaId": "A18A7EB7-D0E7-4269-BDCC-38AE227738BB", "versionEndExcluding": "1.1.25", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Prior to version 1.1.25, Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange flow. When pulling a model, Model Runner follows the realm URL from the registry's WWW-Authenticate header without validating the scheme, hostname, or IP range. A malicious OCI registry can set the realm to an internal URL (e.g., http://127.0.0.1:3000/), causing Model Runner running on the host to make arbitrary GET requests to internal services and reflect the full response body back to the caller. Additionally, the token exchange mechanism can relay data from internal services back to the attacker-controlled registry via the Authorization: Bearer header. This issue has been patched in version 1.1.25. For Docker Desktop users, enabling Enhanced Container Isolation (ECI) blocks container access to Model Runner, preventing exploitation. However, if the Docker Model Runner is exposed to localhost over TCP in specific configurations, the vulnerability is still exploitable."}, {"lang": "es", "value": "Docker Model Runner (DMR) es un software utilizado para gestionar, ejecutar y desplegar modelos de IA usando Docker. Antes de la versi\u00f3n 1.1.25, Docker Model Runner contiene una vulnerabilidad SSRF en su flujo de intercambio de tokens del registro OCI. Al extraer un modelo, Model Runner sigue la URL del realm del encabezado WWW-Authenticate del registro sin validar el esquema, el nombre de host o el rango de IP. Un registro OCI malicioso puede establecer el realm a una URL interna (por ejemplo, http://127.0.0.1:3000/), haciendo que Model Runner, ejecut\u00e1ndose en el host, realice solicitudes GET arbitrarias a servicios internos y refleje el cuerpo completo de la respuesta de vuelta al llamador. Adem\u00e1s, el mecanismo de intercambio de tokens puede retransmitir datos de servicios internos de vuelta al registro controlado por el atacante a trav\u00e9s del encabezado Authorization: Bearer. Este problema ha sido parcheado en la versi\u00f3n 1.1.25. Para los usuarios de Docker Desktop, habilitar el Aislamiento Mejorado de Contenedores (ECI) bloquea el acceso del contenedor a Model Runner, previniendo la explotaci\u00f3n. Sin embargo, si Docker Model Runner est\u00e1 expuesto a localhost sobre TCP en configuraciones espec\u00edficas, la vulnerabilidad sigue siendo explotable."}], "id": "CVE-2026-33990", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33990", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-04T03:01:15.736753Z", "version": "2.0.3"}}]}, "published": "2026-04-01T17:28:39.823", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/docker/model-runner/security/advisories/GHSA-x2f5-332j-9xwq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.25)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "model-runner", "source": "cna", "vendor": "docker"}, "product": "model-runner", "vendor": "docker"}], "analysis": {"en": {"generated_at": "2026-04-14T21:48:00.669851+00:00", "value": {"mitigation_remediation": ["Upgrade Docker Model Runner to version 1.1.25 or newer", "Enable Enhanced Container Isolation (ECI) in Docker Desktop if possible", "Restrict the Model Runner service so it is not exposed to localhost over TCP", "Monitor registry logs for suspicious WWW-Authenticate realm values or Authorization headers", "Contact Docker support if legacy versions must remain in use"], "summary": {"action": "Patch Immediately", "impact": "Internal Network Access and Data Exfiltration"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Docker Model Runner versions prior to 1.1.25. Docker Desktop users are protected when Enhanced Container Isolation (ECI) is enabled, because it blocks container access to the DMR service. However, if DMR is exposed to localhost over TCP in certain configurations, the SSRF flaw remains exploitable. Any deployment of DMR that does not run the patched version could be impacted.", "description_and_impact": "Docker Model Runner (DMR) stores an SSRF weakness in its OCI registry token exchange flow. The client blindly follows the realm URL provided in the WWW-Authenticate header of the registry response, ignoring scheme, hostname, or IP range checks. A malicious OCI registry can set the realm to an internal address such as http://127.0.0.1:3000/, causing the DMR running on the host to issue arbitrary HTTP GET requests to internal services. The full response body is returned to the caller, and the token exchange mechanism can also forward data from internal services back to the attacker through the Authorization: Bearer header. This allows an attacker to read internal resources and potentially exfiltrate sensitive data. The weakness is classified as CWE\u2011918 (Server\u2011Side Request Forgery).", "risk_and_exploitability": "The CVSS base score is 6.8, indicating a medium severity vulnerability. EPSS is reported as less than 1%, suggesting a low probability of widespread exploitation, and it is not listed in the CISA KEV catalog. The attack requires the attacker to control or influence an OCI registry that the DMR will pull a model from. Once the manipulative registry is accessed, the client\u2019s unvalidated request gives the attacker access to internal network services and the ability to leak internal data. Deployments with local TCP exposure are at the highest risk, while configurations protected by ECI or upgraded to 1.1.25 are safe."}}}}, "created": "2026-04-02T07:48:50.405290+00:00", "updated": "2026-04-15T16:30:09.778198+00:00", "vendors": ["docker", "docker$PRODUCT$model-runner"]}