Docker model-runner up to 1.0.15 API /engines/_configure routine

Summaryinfo

A vulnerability marked as critical has been reported in Docker model-runner up to 1.0.15. The affected element is an unknown function of the file /engines/_configure of the component API. The manipulation leads to routine. This vulnerability is listed as CVE-2026-28400. The attack must be carried out locally. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Docker model-runner up to 1.0.15 and classified as critical. This issue affects an unknown code of the file /engines/_configure of the component API. The manipulation with an unknown input leads to a routine vulnerability. Using CWE to declare the problem leads to CWE-749. The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST `/engines/_configure` endpoint that accepts arbitrary runtime flags without authentication. These flags are passed directly to the underlying inference server (llama.cpp). By injecting the --log-file flag, an attacker with network access to the Model Runner API can write or overwrite arbitrary files accessible to the Model Runner process. When bundled with Docker Desktop (where Model Runner is enabled by default since version 4.46.0), it is reachable from any default container at model-runner.docker.internal without authentication. In this context, the file overwrite can target the Docker Desktop VM disk (`Docker.raw` ), resulting in the destruction of all containers, images, volumes, and build history. However, in specific configurations and with user interaction, it is possible to convert this vulnerability in a container escape. The issue is fixed in Docker Model Runner 1.0.16. Docker Desktop users should update to 4.61.0 or later, which includes the fixed Model Runner. A workaround is available. For Docker Desktop users, enabling Enhanced Container Isolation (ECI) blocks container access to Model Runner, preventing exploitation. However, if the Docker Model Runner is exposed to localhost over TCP in specific configurations, the vulnerability is still exploitable.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-28400 since 02/27/2026. The exploitation is known to be difficult. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 1.0.16 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-9073). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Virtualization Software

Vendor

• Docker

Name

• model-runner

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15

Website

• Product: https://github.com/docker/model-runner/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion