BentoML hat eine Path Traversal-Schwachstelle über Bentofile-Konfiguration

The primary impact of CVE-2026-24123 is the potential for supply chain attacks. An attacker can embed malicious content, such as SSH keys, credentials, or sensitive environment variables, within a BentoML archive (bento). This occurs when a victim builds a crafted bentofile.yaml which contains path traversal sequences. When the victim builds the bento, the attacker-controlled files are silently included. These compromised bentos can then be pushed to registries or deployed, potentially compromising downstream systems. The ability to extract arbitrary files significantly expands the attack surface, allowing attackers to gain access to sensitive data and potentially escalate privileges.

Organizations heavily reliant on BentoML for deploying machine learning models, particularly those using shared Bento registries or automated build pipelines, are at increased risk. Teams using BentoML in CI/CD environments or those integrating BentoML with other systems that handle sensitive data are also particularly vulnerable.

• python: Monitor BentoML build processes for unusual file access patterns. Use strace or similar tools to observe file system calls made during Bento builds.

strace -e trace=file -p <bentoml_process_id>

• generic web: Inspect BentoML registry images for unexpected files or anomalies. Check the contents of deployed Bentos for suspicious files. • linux / server: Examine system logs for attempts to access files outside of the expected BentoML working directory. Use auditd to monitor file access events.

auditctl -w /path/to/bentoml/working/directory -p wa -k bentoml_access

1. 2026-01-26Disclosure

   disclosure

1. Reserviert2026-01-21
2. Veröffentlicht2026-01-26
3. Geändert2026-02-03
4. EPSS aktualisiert2026-03-23

The recommended mitigation is to upgrade to BentoML version 1.4.34 or later, which addresses the path traversal vulnerability. If upgrading is not immediately feasible, consider implementing strict input validation on bentofile.yaml files to prevent path traversal attempts. This can involve whitelisting allowed characters and restricting the depth of file paths. Additionally, review any existing bentos for suspicious content before deployment. There are no specific WAF rules or detection signatures readily available, so focusing on input validation and regular security audits is crucial.