Bentoml vulnerabilities

Products

• Bentoml 14
• Bentoml/bentoml 3

Newest

• bentoml BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys CVE-2026-112264 8.5 HighOctober 19, 2026
• bentoml BentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address Space CVE-2026-78205 6.9 MediumAugust 24, 2026
• bentoml openllm bentoml OpenLLM Model Repository Directory Name common.py async_run_command command injection CVE-2026-15035 4.8 MediumJuly 8, 2026
• bentoml BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml CVE-2026-44346 Fix available 8.8 HighMay 11, 2026
• bentoml BentoML: Dockerfile command injection via docker.base_image CVE-2026-44345 Fix available 8.8 HighMay 11, 2026
• bentoml BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context CVE-2026-40610 Fix available 5.5 MediumMay 7, 2026
• bentoml BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generation CVE-2026-35044 Fix available 8.8 HighApril 3, 2026
• bentoml BentoML: command injection in cloud deployment setup script (deployment.py) CVE-2026-35043 Fix available 7.8 HighApril 3, 2026
• bentoml BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml CVE-2026-33744 Fix available 7.8 HighMarch 26, 2026
• bentoml BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction CVE-2026-27905 Fix available 8.6 HighMarch 3, 2026
• bentoml BentoML has a Path Traversal via Bentofile Configuration CVE-2026-24123 Fix available 7.4 HighJanuary 26, 2026
• bentoml BentoML is Vulnerable to an SSRF Attack Through File Upload Processing CVE-2025-54381 Public exploitFix available EPSS 13.2% 9.9 CriticalJuly 29, 2025
• bentoml Insecure Deserialization leads to RCE in BentoML's runner server CVE-2025-32375 Public exploitFix available EPSS 52.4% 9.8 CriticalApril 9, 2025
• bentoml BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization CVE-2025-27520 Public exploitFix available EPSS 40.6% 9.8 CriticalApril 4, 2025
• bentoml bentoml/openllm Local File Inclusion in bentoml/openllm CVE-2024-8982 6.2 MediumMarch 20, 2025
• bentoml bentoml/bentoml Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml CVE-2024-9070 9.8 CriticalMarch 20, 2025
• bentoml bentoml/bentoml Denial of Service in bentoml/bentoml CVE-2024-9056 7.5 HighMarch 20, 2025
• bentoml, bentoml bentoml/bentoml +1 more Insecure Deserialization Leading to RCE in bentoml/bentoml CVE-2024-2912 Fix available 10.0 CriticalApril 16, 2024