The vulnerability CVE-2026-5817 affects Docker Desktop 4.62.0 on macOS through the vllm-metal inference backend in Docker Model Runner. It unconditionally enables trust_remote_code when loading model tokenizers, allowing transformers.AutoTokenizer.from_pretrained() to execute arbitrary Python files included in any model pulled from an OCI registry. This leads to arbitrary code execution on the host as the Docker Desktop user. Exploitation can be triggered by any container on the Docker network via the model-runner.docker.internal API by pulling a malicious model and requesting inference. The vulnerability is classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). No patch or official remediation has been published yet.

Successful exploitation results in arbitrary code execution on the Docker host with the privileges of the Docker Desktop user. This can be triggered remotely by any container on the Docker network, potentially compromising the host system and any data or processes accessible to the Docker Desktop user. The vulnerability thus poses a significant risk to host integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the model-runner.docker.internal API and avoid running untrusted containers or pulling untrusted models that could trigger inference. Monitoring vendor communications for updates is recommended.