ZDI-CAN-29308: ZDI-26-451: Docker Desktop for macOS Inference Server Permissive Allow List Sandbox Escape Vulnerability

Published Jul 23, 2026

Updated

This vulnerability allows local attackers to escape the model runner sandbox on affected installations of Docker Desktop for macOS. An attacker must first obtain the ability to execute low-privileged code within the sandbox in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8.

Affected Software

1 affected component

Docker Docker Desktop for macOS

Event History

Jul 23, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-29308?

ZDI-CAN-29308 has a risk score of 52, indicating a moderate severity level.

What exploit is associated with ZDI-CAN-29308?

ZDI-CAN-29308 allows local attackers to escape the model runner sandbox in Docker Desktop for macOS.

How do I fix ZDI-CAN-29308?

To mitigate ZDI-CAN-29308, ensure you are using the latest version of Docker Desktop for macOS that addresses this vulnerability.

Who is affected by ZDI-CAN-29308?

ZDI-CAN-29308 affects users of Docker Desktop for macOS who have local installations.

What is required to exploit ZDI-CAN-29308?

An attacker must obtain the ability to execute low-privileged code within the sandbox to exploit ZDI-CAN-29308.