CVE-2026-112264High· 7.8▾ MidnightPoC availableBentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attacker…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 42.9 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Exploit / PoC code exists
0.2%
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.
BentoML <= 1.4.39Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-54381Critical· 9.9BentoML SSRF Vulnerability in File Upload Processing
CVE-2025-27520Critical· 9.8BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
CVE-2024-2912Critical· 9.8Insecure deserialization in BentoML
CVE-2024-9070Critical· 9.8BentoML deserialization vulnerability
CVE-2026-33744High· 7.8BentoML is a Python library for building online serving systems optimized for AI apps and model inference
CVE-2018-11138Critical· 9.8The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.