BentoML CVE-2026-112264

Exploitation requires a victim to run bentoml containerize (or an equivalent build) against an attacker-controlled bentofile.yaml or an imported bento archive in which a docker.env mapping key contains an embedded newline, and the build must use the legacy base.j2 Dockerfile template path present in BentoML through 1.4.39. Limiting factors: it is not remotely triggerable (AV:L) and demands user interaction (UI:P) - the target must voluntarily build/containerize untrusted content; impact is maximized only when build secrets are mounted during the docker build and the resulting image is subsequently trusted/deployed. Environments that only build their own first-party bentos are not realistically exposed.

This is a build-time supply-chain injection flaw (CWE-78) rather than a remotely-triggerable service vulnerability. The only CVSS data provided is a CVSS 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) scoring 8.5/High; no CVSS 3.1 vector, no EPSS score, and no KEV listing were supplied. The signals are internally consistent: AV:L plus UI:P correctly reflects that exploitation requires a victim to locally run bentoml containerize against an attacker-supplied bentofile.yaml or imported bento archive - it is NOT network-reachable or autonomously wormable, which caps real-world mass-exploitation potential. PR:N is accurate in that the attacker needs no privileges on the target, but the attack is gated entirely by the victim choosing to build an untrusted bento. The VC:H/VI:H/VA:H impact is justified because injected RUN instructions execute in the docker build context, exposing build secrets (BuildKit secrets, registry/cloud credentials) and poisoning the resulting image. With no EPSS and no KEV, there is no evidence of widespread or active exploitation; this is a credible, high-impact issue for CI/CD and MLOps pipelines that build third-party bentos, but priority should be scoped to environments that containerize untrusted model packages rather than treated as an internet-facing emergency. The geo-chen and VulnCheck references appear to be technical research write-ups; absent an explicit POC=YES or KEV signal, exploitation maturity should be treated as proof-of-concept/research-grade only.

An attacker publishes or shares a malicious BentoML package whose docker.env mapping key contains an embedded newline followed by arbitrary Dockerfile directives. A victim engineer or CI pipeline imports the bento and runs bentoml containerize, at which point the legacy base.j2 template renders the injected newline as a new RUN instruction that docker build executes - reading mounted build secrets and backdooring the produced image. No public exploit is flagged in the input, though technical write-ups describing the flaw are referenced.