LiveThreat Vulnerability Brief — CVE‑2026‑28400
What It Is — A local denial‑of‑service flaw in Docker Desktop for Mac’s Model Runner component, caused by exposure of a dangerous function that can be triggered by low‑privileged code. Exploitability — Requires an attacker to already run low‑privileged code on the host; no public exploit, but proof‑of‑concept exists; CVSS 7.3 (High). Affected Products — Docker Desktop for Mac (and related Docker Desktop releases) from Docker. TPRM Impact — Compromised developer workstations can halt CI/CD pipelines, corrupt build artifacts, and propagate malicious images to downstream partners, creating a supply‑chain risk. Recommended Actions — Deploy Docker’s March 2026 patch immediately, inventory all third‑party environments using Docker Desktop, enforce least‑privilege execution on developer machines, consider disabling Model Runner if not required, and monitor logs for abnormal Docker Desktop crashes. Source: Zero Day Initiative advisory