CVE-2026-112264 in BentoML
Summary
by MITRE • 10/19/2026
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
BentoML versions up to 1.4.39 are susceptible to a critical Dockerfile instruction injection vulnerability stemming from improper sanitization of user-supplied input within the legacy base.j2 template used for generating Dockerfiles during containerization processes. This flaw allows authenticated or remote attackers who can influence the configuration files, specifically through crafted bentofile.yaml configurations or imported bento archives, to inject arbitrary commands into the build context. The vulnerability is triggered when newlines are embedded within docker.env mapping keys, which are then rendered directly into the Dockerfile without adequate escaping or validation mechanisms in place by the legacy template engine.
The technical mechanism of this exploit relies on the way the containerize command processes environment variable definitions. When a user provides an environment key containing newline characters, the rendering process fails to treat these as literal string values within the ENV instruction context. Instead, the injected newlines break out of the intended single-line format and introduce subsequent lines that are interpreted by Docker as distinct instructions during the build phase. This effectively allows an attacker to execute arbitrary RUN commands with the privileges of the build environment, which typically includes access to sensitive configuration files, network credentials, and other secrets required for building or deploying machine learning models.
The operational impact of this vulnerability is severe, encompassing both confidentiality and integrity compromises within the CI/CD pipeline and development workflows that utilize BentoML. Attackers can exfiltrate build secrets such as API keys, database passwords, or private repository tokens by echoing them to standard output or sending them to external servers via HTTP requests embedded in the injected RUN instructions. Furthermore, this vulnerability enables image poisoning where malicious code is baked into the resulting container image. This compromised image may then be deployed to production environments, leading to potential remote code execution on target infrastructure and persistent backdoors that are difficult to detect due to their integration into legitimate build artifacts.
From a classification perspective, this issue aligns with CWE-94 Improper Control of Generation of Code or Script typically categorized under injection flaws where user input is not properly neutralized before being passed to an interpreter. In the context of attack tactics and techniques, this vulnerability facilitates lateral movement and credential access consistent with ATT&CK technique T1059 Command and Scripting Interpreter, specifically through shell commands executed during the build process. It also relates to supply chain compromise vectors where trusted tools are manipulated to produce malicious artifacts that propagate trust downstream to deployment targets.
Mitigation strategies for this vulnerability involve immediate upgrades to BentoML version 1.4.40 or later where the issue has been addressed by improving input validation and template rendering logic. Organizations should audit their CI/CD pipelines for any usage of legacy base.j2 templates and migrate to updated templating mechanisms that enforce strict type checking and escaping rules for environment variables. Additionally, implementing least-privilege principles in build environments can limit the damage if an injection occurs by restricting access to sensitive secrets during the containerization phase. Security teams should also scan existing bento archives and configuration files for signs of tampering or unexpected newline characters within key-value pairs before deployment.