BentoML EUVD-2026-64680

Exploitation requires a BentoML server running version 1.4.19 through 1.4.39 that accepts either multipart file uploads processed by MultipartSerde.ensure_file or JSON request bodies processed by JSONSerde.parse_request, both of which are standard BentoML serving paths and require no special configuration to enable. The CVSS 4.0 vector (PR:N/UI:N/AV:N/AC:L/AT:N) confirms no authentication, no user interaction, and no attack prerequisites are required against the BentoML server itself. Exploitation impact is bounded by whether meaningful targets exist at CGNAT (100.64.0.0/10) addresses in the deployment environment - standard enterprise networks without CGNAT infrastructure will see reduced practical impact, while ISP infrastructure, carrier environments, or cloud platforms using CGNAT for internal routing face direct exposure of internal services. Network egress restrictions that independently block 100.64.0.0/10 at the OS or firewall layer would mitigate the flaw regardless of patch status.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N, score 6.9) reflects network-reachable, unauthenticated, zero-complexity exploitation with limited confidentiality impact on both the vulnerable system and subsequent CGNAT hosts. Real-world risk is deployment-context dependent: organizations running BentoML in ISP infrastructure, carrier-grade environments, or cloud platforms using CGNAT internally face meaningful exposure to internal service probing and data exfiltration. In standard enterprise deployments without CGNAT-addressed internal services, practical impact is substantially reduced even though the vulnerability is still exploitable. No EPSS score was provided in the input data; KEV status is not listed, and no public exploit code has been identified - these signals are absent rather than confirmed negative, so escalation risk cannot be ruled out given the well-scoped incomplete-fix characterization that lowers the bar for targeted exploitation. The incomplete-fix nature relative to CVE-2025-54381 implies the original SSRF attack surface is well-documented, reducing attacker research effort.

An unauthenticated attacker sends a crafted HTTP request to a publicly exposed BentoML API endpoint - either a multipart file upload with a URL field resolving to a 100.64.x.x address, or a JSON body containing such a URL. Because make_safe_connect does not reject RFC 6598 addresses, BentoML initiates an outbound HTTP request to the CGNAT-addressed host, and any response content may be reflected or logged in ways the attacker can observe. In ISP or cloud environments where CGNAT addresses front internal services such as management APIs, metadata endpoints, or microservices, this yields unauthorized read access to those systems.