Docker Model Runner provides a POST /engines/_configure endpoint that accepts any runtime flag without authentication. An attacker who can reach the endpoint can inject arbitrary flags – for example --log-file – causing the underlying inference server to create or overwrite files that are accessible to the Model Runner process. This allows an unauthenticated attacker to corrupt or delete files on the host, potentially destroying Docker Desktop VM disks and all containers, images, and volumes. In certain environments with user interaction, the flaw can be extended to a container escape, giving the attacker broader host control.

The vulnerability exists in Docker Model Runner versions earlier than 1.0.16. Docker Desktop releases from 4.46.0 onward bundle Model Runner enabled by default, exposing the API to any container via the internal DNS name model-runner.docker.internal. The endpoint is also reachable if the Model Runner API is explicitly exposed at localhost over TCP. Attackers with network connectivity to the API can exploit these configurations.

The CVSS score of 7.6 reflects a high impact exploit, but the EPSS score of less than 1% indicates a low current probability of attack. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs network access to the Model Runner API; the flaw is unauthenticated, making it straightforward to craft requests. The attacker can overwrite critical files such as Docker.raw, causing loss of all Docker data, or in specific setups perform a container escape. The presence of an exposed TCP endpoint further increases the attack surface.