Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Prior to version 1.1.25, Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange flow. When pulling a model, Model Runner follows the realm URL from the registry's WWW-Authenticate header without validating the scheme, hostname, or IP range. A malicious OCI registry can set the realm to an internal URL (e.g., http://127.0.0.1:3000/), causing Model Runner running on the host to make arbitrary GET requests to internal services and reflect the full response body back to the caller. Additionally, the token exchange mechanism can relay data from internal services back to the attacker-controlled registry via the Authorization: Bearer header. This issue has been patched in version 1.1.25. For Docker Desktop users, enabling Enhanced Container Isolation (ECI) blocks container access to Model Runner, preventing exploitation. However, if the Docker Model Runner is exposed to localhost over TCP in specific configurations, the vulnerability is still exploitable.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Prior to     version 1.1.25, Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange     flow. When pulling a model, Model Runner follows the realm URL from the registry's WWW-Authenticate header     without validating the scheme, hostname, or IP range. A malicious OCI registry can set the realm to an     internal URL (e.g., http://127.0.0.1:3000/), causing Model Runner running on the host to make arbitrary     GET requests to internal services and reflect the full response body back to the caller. Additionally, the     token exchange mechanism can relay data from internal services back to the attacker-controlled registry     via the Authorization: Bearer header. This issue has been patched in version 1.1.25. For Docker Desktop     users, enabling Enhanced Container Isolation (ECI) blocks container access to Model Runner, preventing     exploitation. However, if the Docker Model Runner is exposed to localhost over TCP in specific     configurations, the vulnerability is still exploitable. (CVE-2026-33990)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Docker Desktop installed on the remote host is prior to 4.67.0. It is, therefore, affected by a server-side request forgery (SSRF) vulnerability:

  - Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange flow. When pulling a model,     Model Runner follows the realm URL from the registry's WWW-Authenticate header without validating the scheme,     hostname, or IP range. A malicious OCI registry can set the realm to an internal URL, causing Model Runner running     on the host to make arbitrary GET requests to internal services and reflect the full response body back to the     caller. (CVE-2026-33990)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Prior to
    version 1.1.25, Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange
    flow. When pulling a model, Model Runner follows the realm URL from the registry's WWW-Authenticate header
    without validating the scheme, hostname, or IP range. A malicious OCI registry can set the realm to an
    internal URL (e.g., http://127.0.0.1:3000/), causing Model Runner running on the host to make arbitrary
    GET requests to internal services and reflect the full response body back to the caller. Additionally, the
    token exchange mechanism can relay data from internal services back to the attacker-controlled registry
    via the Authorization: Bearer header. This issue has been patched in version 1.1.25. For Docker Desktop
    users, enabling Enhanced Container Isolation (ECI) blocks container access to Model Runner, preventing
    exploitation. However, if the Docker Model Runner is exposed to localhost over TCP in specific
    configurations, the vulnerability is still exploitable. (CVE-2026-33990)

ID	Name	Product	Family	Type	Severity
304759	Linux Distros Unpatched Vulnerability : CVE-2026-33990	Nessus	Misc.	Local	medium
304670	Docker Desktop < 4.67.0 SSRF (CVE-2026-33990)	Nessus	Misc.	Local	medium
439476	SCA: security update for github.com/docker/model-runner (GHSA-x2f5-332j-9xwq)	Tenable Cloud Security	SCA Checks	Local	medium
439476	SCA: security update for github.com/docker/model-runner (GHSA-x2f5-332j-9xwq)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-33990

medium

Tenable Plugins

medium

medium

medium

medium