CVE-2026-112264
HighCVSS 7.8Summary
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability allowing attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. A crafted bentofile.yaml or imported bento archive can cause bentoml containerize to execute injected RUN instructions during docker build, accessing build secrets and poisoning images.
Risk Assessment
An attacker could access build secrets and poison container images, potentially leading to compromise of the production environment. CI/CD pipelines using BentoML are at risk.
Recommendation
Update BentoML to a version containing the fix or validate templates rendering docker.env. Also restrict trust in bentofile.yaml and imported bento archives.
Other vulnerabilities in BentoML
See all- CVE-2026-78205Medium
In BentoML, the outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space (100.64.0.0/10, CGNAT). In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointing to that range via multipart file handling (MultipartSerde.ensure_file) or JSON request parsing (JSONSerde.parse_request), causing the server to make outbound requests to internal hosts on CGNAT networks (Server-Side Request Forgery). This is an incomplete fix for CVE-2025-54381.
- CVE-2026-40610Medium
In BentoML versions 1.4.38 and prior, the build packaging workflow follows attacker-controlled symlinks inside the build context and copies the referenced file contents into the generated Bento artifact. An attacker can place a symlink pointing to a sensitive local file, which gets packaged into the Bento.
Original NVD description (English source)
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS