Bentoml
CVE-2026-24123
HIGH
GHSA-6r62-w2q3-48hf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious bentofile.yaml with path traversal payloads
-
DeliveryDistribute bentofile to victim developer
-
ExploitVictim builds bento archive via BentoML
-
ExecutionArbitrary files exfiltrated into archive
-
ImpactSensitive credentials exposed in supply chain
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Victim must build a BentoML project using attacker-controlled bentofile.yaml containing path traversal sequences in path fields (description, docker.setup_script, docker.dockerfile_template, conda.environment_yml). Requires BentoML version prior to 1.4.34 and user interaction to execute bento build command. |
| Impact | CVSS 7.4 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: Required. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
BentoML versions prior to 1.4.34 allow path traversal attacks through improperly validated file path fields in bentofile.yaml configurations, enabling attackers to embed arbitrary files from the victim's system into bento archives during the build process. This vulnerability can be exploited to exfiltrate sensitive data such as credentials, SSH keys, and environment variables into supply chain artifacts that may be pushed to registries or deployed in production environments. A patch is available in version 1.4.34.
Earlier versions of this analysis (1)
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. [CVSS 7.4 HIGH]
RemediationAI
A vendor patch is available — apply it immediately. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-22 (Path Traversal). Affects Bentoml. BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields (description, docker.setup_script, docker.dockerfile_template, conda.environment_yml). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply ch
Know when Bentoml gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields (description, docker.setup_script, docker.dockerfile_template, conda.environment_yml). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed. Version 1.4.34 contains a patch for the issue.
Executive ViewAI
A HIGH severity vulnerability (CVE-2026-24123) affects BentoML, a Python library used for AI model serving infrastructure. Organizations running BentoML in production environments face potential unauthorized access or data compromise risks. Immediate patching is required to prevent exploitation of inference serving systems that may process sensitive data or models.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)GitHub Advisory
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
Arbitrary file write in BentoML allows an attacker-supplied bento or model tar archive to escape the extraction director
BentoML through 1.4.39 renders attacker-controlled docker.env mapping keys into its legacy base.j2 Dockerfile template w
Server-Side Request Forgery in BentoML versions 1.4.19 through 1.4.39 exposes internal CGNAT infrastructure by failing t
Command injection in bentoml OpenLLM 0.6.30 allows local low-privilege users to execute arbitrary shell commands by supp
Exploit-DB