bentoml BentoML vulnerabilities

CVEs per yearBy the year they were published

1. 20253
2. 202610

Newest CVEs

• CVE-2026-112264

  BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys

  bentoml · BentoML

  High8.5
• CVE-2026-78205

  BentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address Space

  bentoml · BentoML

  Medium6.9
• CVE-2026-44345

  BentoML: Dockerfile command injection via docker.base_image

  bentoml · BentoML

  High8.8
• CVE-2026-44346

  BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml

  bentoml · BentoML

  High8.8
• CVE-2026-40610

  BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context

  bentoml · BentoML

  Medium5.5
• CVE-2026-35044

  BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generation

  bentoml · BentoML

  High8.8
• CVE-2026-35043

  BentoML: command injection in cloud deployment setup script (deployment.py)

  bentoml · BentoML

  High7.8
• CVE-2026-33744

  BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml

  bentoml · BentoML

  High7.8
• CVE-2026-27905

  BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction

  bentoml · BentoML

  High8.6
• CVE-2026-24123

  BentoML has a Path Traversal via Bentofile Configuration

  bentoml · BentoML

  High7.4