BentoML: Dockerfile instruction injection via docker.env keys
Summary
BentoML up to and including 1.4.39 does not filter newlines in docker.env keys that are rendered by the legacy base.j2 template. An attacker who supplies a crafted bentofile.yaml or imported bento archive can inject arbitrary RUN instructions that execute during docker build when a victim runs bentoml containerize. This can expose build secrets and lead to poisoned container images. The attack requires user interaction and a build of attacker-controlled content.
Affected
- BentoML 0 through 1.4.39
- Legacy base.j2 Dockerfile template, dict form of docker.env keys
Fixed in
Unknown. No vendor-confirmed fixed version. A fix in BentoML 1.4.40 is not confirmed.
Workaround
- Build bentos only from trusted sources and review bentofile.yaml for multi-line or unusual docker.env keys before running bentoml containerize.
- Do not import bento archives from untrusted parties.
- Run builds in isolated CI runners without production secrets, registry credentials or cloud keys.
Exploitation
- A public proof of concept exists for the docker.env dict form at v1.4.39.
- CISA SSVC: exploitation status poc, not automatable.
- No confirmed exploitation in the wild in the sources reviewed.
Our recommendation
- Check whether any system builds BentoML images from third-party or untrusted bentofile.yaml files or bento archives.
- Isolate build pipelines and remove production secrets from them.
- Track the BentoML project for a confirmed fix and rebuild images after upgrading.
- Review existing images built from untrusted inputs.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-112264 osv.dev
- BentoML build_config.py at v1.4.39 github.com
- BentoML container __init__.py at v1.4.39 github.com
- Proof of concept write-up (Hugging Face) huggingface.co
- BentoML GitHub releases github.com
- HOL Guard CVE entry hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:25.
Original description (NVD)
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.
NVD references (7)
- https://github.com/bentoml/BentoML/blob/v1.4.39/src/bentoml/_internal/bento/build_config.py
- https://github.com/bentoml/BentoML/blob/v1.4.39/src/bentoml/_internal/container/__init__.py
- https://github.com/bentoml/BentoML/blob/v1.4.39/src/bentoml/_internal/container/frontend/dockerfile/templates…
- https://github.com/bentoml/BentoML/blob/v1.4.39/src/bentoml/_internal/container/generate.py
- https://github.com/geo-chen/oss/blob/main/BentoML.md
- https://www.vulncheck.com/advisories/bentoml-through-1.4.39-dockerfile-instruction-injection-via-docker-env-k…
- https://github.com/geo-chen/oss/blob/main/BentoML.md
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.