CVE-2026-5817: Docker Model Runner container-to-host code execution via unsandboxed trust_remote_code in Python inference backends
The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trustremotecode=True when loading model tokenizers, and runs without sandboxing. This causes transformers.AutoTokenizer.frompretrained() to import and execute arbitrary Python files included in any model pulled from an OCI registry, resulting in arbitrary code execution on the Docker host as the Docker Desktop user when inference is triggered.
Any container on the Docker network can trigger this by calling the model-runner.docker.internal API to pull a malicious model and request inference.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5817?
CVE-2026-5817 has a high severity rating of 8.2.
How does CVE-2026-5817 impact Docker users?
CVE-2026-5817 allows for container-to-host code execution due to unsandboxed execution of remote code.
How do I fix CVE-2026-5817?
To mitigate CVE-2026-5817, avoid using trust_remote_code=True when loading model tokenizers in Docker Model Runner.
What versions of Docker are affected by CVE-2026-5817?
CVE-2026-5817 affects the Docker Model Runner using the vllm-metal inference backend.
What is the nature of the vulnerability in CVE-2026-5817?
The vulnerability in CVE-2026-5817 allows arbitrary Python files to be executed, leading to potential remote code execution.