Docker Model Runner (DMR) before version 1.1.25 has an SSRF vulnerability (CWE-918) in its OCI registry token exchange process. When pulling models, DMR follows the realm URL from the registry's WWW-Authenticate header without validating its scheme, hostname, or IP range. A malicious OCI registry can set this realm to an internal URL (e.g., http://127.0.0.1:3000/), causing DMR running on the host to send arbitrary GET requests to internal services. The full response body from these internal services is reflected back to the attacker. Additionally, the token exchange can relay data from internal services back to the attacker-controlled registry via the Authorization: Bearer header. This vulnerability is fixed in version 1.1.25. Docker Desktop's Enhanced Container Isolation (ECI) feature blocks container access to Model Runner, mitigating exploitation, but exposure of Model Runner to localhost over TCP in certain configurations remains a risk.

An attacker controlling a malicious OCI registry can exploit this SSRF vulnerability to make Docker Model Runner send arbitrary GET requests to internal services on the host. This can lead to unauthorized disclosure of internal service responses to the attacker. The attacker can also relay data from internal services back to their registry via the Authorization header. This could potentially expose sensitive internal information. The vulnerability requires local or low-privilege access (AV:L, PR:L) and has no user interaction requirement. The CVSS 4.0 base score is 6.8 (medium severity). No known exploits in the wild have been reported.

Upgrade Docker Model Runner to version 1.1.25 or later, where this SSRF vulnerability is patched. For Docker Desktop users, enabling Enhanced Container Isolation (ECI) prevents container access to Model Runner and mitigates exploitation. Avoid exposing Docker Model Runner to localhost over TCP in configurations that allow external access, as this can still permit exploitation despite ECI. Patch status is confirmed fixed in version 1.1.25.