CVE-2026-78205
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
In BentoML, the outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space (100.64.0.0/10, CGNAT). In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointing to that range via multipart file handling (MultipartSerde.ensure_file) or JSON request parsing (JSONSerde.parse_request), causing the server to make outbound requests to internal hosts on CGNAT networks (Server-Side Request Forgery). This is an incomplete fix for CVE-2025-54381.
Risk Assessment
An attacker can use the server to scan the internal CGNAT network and access resources that should not be externally accessible. This can lead to data leakage or further attacks.
Recommendation
It is recommended to update BentoML to a version with a complete fix, or manually add a block for the 100.64.0.0/10 range in security configurations. Also restrict access to the server.
Other vulnerabilities in BentoML
See all- CVE-2026-112264High
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability allowing attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. A crafted bentofile.yaml or imported bento archive can cause bentoml containerize to execute injected RUN instructions during docker build, accessing build secrets and poisoning images.
- CVE-2026-40610Medium
In BentoML versions 1.4.38 and prior, the build packaging workflow follows attacker-controlled symlinks inside the build context and copies the referenced file contents into the generated Bento artifact. An attacker can place a symlink pointing to a sensitive local file, which gets packaged into the Bento.
Original NVD description (English source)
BentoML's outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space (100.64.0.0/10, CGNAT). In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointing to that range via multipart file handling (MultipartSerde.ensure_file) or JSON request parsing (JSONSerde.parse_request), causing the server to make outbound requests to internal hosts on CGNAT networks (Server-Side Request Forgery). This is an incomplete fix for CVE-2025-54381.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS