CVE-2026-33990Published
Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-33990 · Microsoft / collected KEV context
cve-program · CVE-2026-33990
euvd · EUVD-2026-17963
nvd · CVE-2026-33990
osv · GHSA-x2f5-332j-9xwq
- https://github.com/docker/model-runner/security/advisories/GHSA-x2f5-332j-9xwq
- https://nvd.nist.gov/vuln/detail/CVE-2026-33990
- https://github.com/docker/model-runner
osv · GO-2026-4911
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.