CVE-2026-33990: 
Docker vulnerability analysis and mitigation

CVE-2026-33990 is a Server-Side Request Forgery (SSRF) vulnerability in Docker Model Runner (DMR), affecting all versions prior to 1.1.25. The flaw resides in the OCI registry token exchange flow, where Model Runner blindly follows the realm URL from a registry's WWW-Authenticate header without validating the scheme, hostname, or IP range. It was published on March 30, 2026, by researcher LucaGuerra, with NVD publication on April 1, 2026. The CVSS v3.1 base score is 9.1 (Critical), while the CVSS v4.0 base score is 6.8 (Medium), reflecting differing scoring perspectives (GitHub Advisory, Github Advisory).

The root cause is CWE-918 (Server-Side Request Forgery), where Docker Model Runner's OCI registry client fails to validate the realm field in the WWW-Authenticate HTTP response header before making token exchange requests. A malicious OCI registry can set the realm to an arbitrary internal URL (e.g., http://127.0.0.1:3000/), causing Model Runner — running with host-level network access — to issue GET requests to internal services and return the full response body to the caller. Furthermore, the token exchange mechanism forwards data from internal services back to the attacker-controlled registry via the Authorization: Bearer header, enabling data exfiltration. The vulnerability requires a user to initiate a model pull from a malicious registry, making user interaction a precondition (GitHub Advisory, Github Advisory).

Successful exploitation allows an attacker to make Docker Model Runner issue arbitrary GET requests to internal services on the host (e.g., localhost, internal network endpoints), effectively bypassing firewall protections and network segmentation. The full HTTP response body from internal services is reflected back to the caller, enabling sensitive data exposure from infrastructure behind network boundaries. Additionally, the token relay mechanism can exfiltrate internal service data to an attacker-controlled registry via the Authorization: Bearer header. Availability is not directly impacted, but confidentiality and, in some configurations, integrity are significantly at risk (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.013% (0.000130), placing it in a low exploitation probability tier. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a user to pull a model from a malicious OCI registry, introducing a social engineering or supply chain component, but no special privileges are required on the attacker's side.

1. Set up a malicious OCI registry: The attacker deploys a rogue OCI-compliant registry server that responds to authentication challenges with a crafted WWW-Authenticate header, setting the realm parameter to an internal target URL (e.g., realm="http://127.0.0.1:8080/internal-api").
2. Lure the victim to pull a model: The attacker distributes or advertises a model hosted on the malicious registry, enticing a Docker Model Runner user to execute a pull command (e.g., docker model pull malicious-registry.example.com/model:latest).
3. Trigger the SSRF: When Model Runner attempts to authenticate with the registry, it reads the realm URL from the WWW-Authenticate header and issues a GET request to the attacker-specified internal URL without validation.
4. Capture internal service response: The response body from the internal service is reflected back to the attacker via the token exchange flow. Sensitive data (e.g., API keys, configuration, metadata) from internal services is returned.
5. Exfiltrate via Bearer token relay: The token exchange mechanism forwards data from the internal service response back to the attacker-controlled registry in the Authorization: Bearer header, completing the data exfiltration (GitHub Advisory).

• Network: Unexpected outbound HTTP GET requests from the Docker Model Runner host process to internal IP ranges (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x) or localhost ports not associated with Docker services; outbound connections to unknown or suspicious OCI registry endpoints.
• Logs: Docker Model Runner logs showing token exchange requests to unusual or internal realm URLs; HTTP requests in access logs from the Model Runner process targeting internal service endpoints.
• Process: The Docker Model Runner process (model-runner) initiating network connections to internal services outside of expected registry communication patterns.
• Network: Outbound Authorization: Bearer headers containing unexpected data payloads sent to external registry endpoints during model pull operations.

Upgrade Docker Model Runner to version 1.1.25 or later, which patches the SSRF vulnerability by validating the scheme, hostname, and IP range of the realm URL before following it. Docker Desktop users should update to version 4.67.0 or later, which bundles the fixed Model Runner. As a partial workaround, Docker Desktop users can enable Enhanced Container Isolation (ECI) to block container access to Model Runner; however, this does not fully mitigate the vulnerability if Model Runner is exposed to localhost over TCP. Additionally, restrict which OCI registries Model Runner is permitted to pull from, and implement network segmentation to limit Model Runner's access to sensitive internal services (GitHub Advisory, Github Advisory).

The Canadian Centre for Cyber Security (CCCS) issued a Docker security advisory (AV26-301) referencing this vulnerability shortly after disclosure (CCCS Advisory). Docker's official security announcements page also references the issue (Docker Security). The vulnerability was credited to researcher davidrxchester as the finder. Community discussion has been limited, with no significant social media amplification or major media coverage observed beyond standard vulnerability tracking and advisory channels.