bentoml vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20256
3. 202611

Newest CVEs

• CVE-2026-112264

  BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys

  bentoml · BentoML

  High8.5
• CVE-2026-78205

  BentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address Space

  bentoml · BentoML

  Medium6.9
• CVE-2026-15035

  bentoml OpenLLM Model Repository Directory Name common.py async_run_command command injection

  bentoml · OpenLLM

  Medium4.8
• CVE-2026-44345

  BentoML: Dockerfile command injection via docker.base_image

  bentoml · BentoML

  High8.8
• CVE-2026-44346

  BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml

  bentoml · BentoML

  High8.8
• CVE-2026-40610

  BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context

  bentoml · BentoML

  Medium5.5
• CVE-2026-35044

  BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generation

  bentoml · BentoML

  High8.8
• CVE-2026-35043

  BentoML: command injection in cloud deployment setup script (deployment.py)

  bentoml · BentoML

  High7.8
• CVE-2026-33744

  BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml

  bentoml · BentoML

  High7.8
• CVE-2026-27905

  BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction

  bentoml · BentoML

  High8.6