Skip to main content

BentoML EUVDEUVD-2026-64680

| CVE-2026-78205 MEDIUM
Server-Side Request Forgery (SSRF) (CWE-918)
2026-08-24 VulnCheck GHSA-x8r7-g3fv-cf37
SSRF Bentoml
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.8 MEDIUM

Network-reachable SSRF with no auth required (PR:N); scope changed (S:C) as requests reach CGNAT internal hosts beyond the vulnerable server; limited confidentiality only, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 24, 2026 - 01:05 vuln.today

DescriptionCVE.org

BentoML's outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space (100.64.0.0/10, CGNAT). In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointing to that range via multipart file handling (MultipartSerde.ensure_file) or JSON request parsing (JSONSerde.parse_request), causing the server to make outbound requests to internal hosts on CGNAT networks (Server-Side Request Forgery). This is an incomplete fix for CVE-2025-54381.

AnalysisAI

Server-Side Request Forgery in BentoML versions 1.4.19 through 1.4.39 exposes internal CGNAT infrastructure by failing to block RFC 6598 shared address space (100.64.0.0/10) in the make_safe_connect safeguard. Unauthenticated remote attackers can supply crafted URLs via multipart file uploads or JSON request bodies, causing the BentoML server to make outbound requests to CGNAT-addressed internal hosts - a class of targets increasingly common in cloud-native and ISP environments. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify exposed BentoML API endpoint
Delivery
Craft URL targeting 100.64.0.0/10 CGNAT range
Exploit
Submit via multipart upload or JSON body
Execution
BentoML make_safe_connect passes CGNAT address
Persist
Server makes outbound request to internal CGNAT host
Impact
Exfiltrate internal service response
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a BentoML server running version 1.4.19 through 1.4.39 that accepts either multipart file uploads processed by `MultipartSerde.ensure_file` or JSON request bodies processed by `JSONSerde.parse_request`, both of which are standard BentoML serving paths and require no special configuration to enable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N, score 6.9) reflects network-reachable, unauthenticated, zero-complexity exploitation with limited confidentiality impact on both the vulnerable system and subsequent CGNAT hosts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker sends a crafted HTTP request to a publicly exposed BentoML API endpoint - either a multipart file upload with a URL field resolving to a 100.64.x.x address, or a JSON body containing such a URL. Because `make_safe_connect` does not reject RFC 6598 addresses, BentoML initiates an outbound HTTP request to the CGNAT-addressed host, and any response content may be reflected or logged in ways the attacker can observe. …
Remediation No patched release version is confirmed from the available input data - the fix status should be verified directly at the GitHub issue tracker (https://github.com/bentoml/BentoML/issues/5644) before assuming a safe upgrade target exists. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Bentoml

View all
CVE-2025-27520 CRITICAL POC
9.8 Apr 04

BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
CVE-2025-32375 CRITICAL POC
9.8 Apr 09

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
CVE-2026-27905 HIGH POC
7.8 Mar 03

Arbitrary file write in BentoML prior to version 1.4.36 allows local attackers to write files to arbitrary locations on

CVE-2026-24123 HIGH
7.4 Jan 26

BentoML versions prior to 1.4.34 allow path traversal attacks through improperly validated file path fields in bentofile

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5
CVE-2026-15409 CRITICAL POC
10.0

Share

EUVD-2026-64680 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy