Detections
Analytics
Docker Desktop < 4.67.0 SSRF (CVE-2026-33990)
medium Nessus Plugin ID 304670
Synopsis
The remote host has an application installed that is affected by a server-side request forgery vulnerability.Description
The version of Docker Desktop installed on the remote host is prior to 4.67.0. It is, therefore, affected by a server-side request forgery (SSRF) vulnerability:- Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange flow. When pulling a model, Model Runner follows the realm URL from the registry's WWW-Authenticate header without validating the scheme, hostname, or IP range. A malicious OCI registry can set the realm to an internal URL, causing Model Runner running on the host to make arbitrary GET requests to internal services and reflect the full response body back to the caller. (CVE-2026-33990)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Docker Desktop version 4.67.0 or later.See Also
Plugin Details
Severity: Medium
ID: 304670
File Name: docker_desktop_cve-2026-33990.nasl
Version: 1.2
Type: Local
Agent: windows, macosx, unix
Family: Misc.
Published: 4/2/2026
Updated: 4/3/2026
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2026-33990
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
Vulnerability Information
CPE: cpe:/a:docker:docker
Patch Publication Date: 3/30/2026
Vulnerability Publication Date: 3/30/2026
Reference Information
CVE: CVE-2026-33990
IAVA: 2026-A-0284