Read the docs
TI-2026-76464 Aliases CVE-2026-112264GHSA-rq23-h86h-7v4x

Dockerfile instruction injection in BentoML via docker.env keys

Priority HIGH 72CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

BentoML through 1.4.39 has a Dockerfile instruction injection flaw (CWE-78) where newlines embedded in docker.env mapping keys are rendered by the legacy base.j2 template. An attacker who supplies a crafted bentofile.yaml or imported bento archive can add arbitrary build instructions that run during docker build, accessing build secrets and poisoning images when a user runs bentoml containerize.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00218 12th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bentomlBentoMLup to 1.4.39—No fix listedCNA
  • BentoML Vendorbentoml Affected up to 1.4.39 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:bentoml:bentoml:*:*:*:*:*:*:*:*——bentoml
  • cpe:2.3:a:bentoml:bentoml:*:*:*:*:*:*:*:* Versions — — ·bentoml

Remediation

The sources list no fixed version for BentoML.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-112264
  2. 2026-10-19 Alias added: GHSA-rq23-h86h-7v4x
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Priority changed: MEDIUM → HIGH

References

Advisory 1

Other 4

  • TI-2025-34190 BentoML is Vulnerable to an SSRF Attack Through File Upload Processing CVSS 3.1CRITICAL 9.9
  • TI-2025-23454 Insecure Deserialization leads to RCE in BentoML's runner server CVSS 3.1CRITICAL 9.8
  • TI-2025-20352 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization CVSS 3.1CRITICAL 9.8
  • TI-2024-08420 Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml CVSS 3.0CRITICAL 9.8
  • TI-2024-02720 Insecure Deserialization Leading to RCE in bentoml/bentoml CVSS 3.1CRITICAL 10.0
  • TI-2026-27247 BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generation CVSS 3.1CRITICAL 9.6
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences