ZDI-26-451: Docker Desktop for macOS Inference Server Permissive Allow List Sandbox Escape Vulnerability
This vulnerability allows local attackers to escape the model runner sandbox on affected installations of Docker Desktop for macOS. An attacker must first obtain the ability to execute low-privileged code within the sandbox in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8.
AI Analysis
Technical Summary
This vulnerability affects the sandbox profile of the inference server process in Docker Desktop for macOS. The flaw arises from a permissive list of allowed inputs in the sandbox configuration, which an attacker with low-privileged code execution inside the sandbox can leverage to escape it. Successful exploitation results in privilege escalation and arbitrary code execution in the context of the current user on the host system. The vulnerability carries a CVSS score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Docker has released a patch to address this issue, with details available in the referenced GitHub commit.
Potential Impact
Local attackers who have the ability to run low-privileged code within the Docker Desktop for macOS model runner sandbox can exploit this vulnerability to escape the sandbox. This leads to privilege escalation and arbitrary code execution with the privileges of the current user on the host system, potentially compromising confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
Docker has issued an update that corrects this vulnerability. Users should apply the official Docker Desktop for macOS update that includes the fix referenced in the GitHub commit (https://github.com/docker/model-runner/commit/980388697b46b799ebc831f26fa83e4e6130f80a) to mitigate this issue.
ZDI-26-451: Docker Desktop for macOS Inference Server Permissive Allow List Sandbox Escape Vulnerability
Description
This vulnerability allows local attackers to escape the model runner sandbox on affected installations of Docker Desktop for macOS. An attacker must first obtain the ability to execute low-privileged code within the sandbox in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the sandbox profile of the inference server process in Docker Desktop for macOS. The flaw arises from a permissive list of allowed inputs in the sandbox configuration, which an attacker with low-privileged code execution inside the sandbox can leverage to escape it. Successful exploitation results in privilege escalation and arbitrary code execution in the context of the current user on the host system. The vulnerability carries a CVSS score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Docker has released a patch to address this issue, with details available in the referenced GitHub commit.
Potential Impact
Local attackers who have the ability to run low-privileged code within the Docker Desktop for macOS model runner sandbox can exploit this vulnerability to escape the sandbox. This leads to privilege escalation and arbitrary code execution with the privileges of the current user on the host system, potentially compromising confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
Docker has issued an update that corrects this vulnerability. Users should apply the official Docker Desktop for macOS update that includes the fix referenced in the GitHub commit (https://github.com/docker/model-runner/commit/980388697b46b799ebc831f26fa83e4e6130f80a) to mitigate this issue.
Technical Details
- Article Source
- {"url":"http://www.zerodayinitiative.com/advisories/ZDI-26-451/","fetched":true,"fetchedAt":"2026-07-23T23:02:00.249Z","wordCount":213}
- Classification
- {"confidence":0.95,"severitySource":"cvss-text","classifier":"rss-v2"}
Threat ID: 6a629e189c2644c7f8de3997
Added to database: 07/23/2026, 23:04:56 UTC
Last enriched: 08/15/2026, 05:19:02 UTC
Last updated: 09/05/2026, 16:35:51 UTC
Views: 160
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.