CVE-2026-24123: Path Traversal in BentoML

The core of the vulnerability lies in BentoML's bentofile.yaml configuration file. Several fields within this file—description, docker.setupscript, docker.dockerfiletemplate, and conda.environment_yml—are susceptible to path traversal attacks. An attacker can craft a malicious bentofile.yaml that, when processed by BentoML during the build process, allows them to read files outside of the intended directory. This extracted data can then be silently included in the resulting Bento archive. The potential impact is severe, as this enables attackers to embed sensitive information—such as SSH keys, credentials, or environment variables—within seemingly benign Bento packages. These compromised Bentos can then be pushed to registries or deployed, effectively spreading the compromise to downstream users. This represents a classic supply chain attack vector, where a trusted component is leveraged to distribute malicious payloads.

1. Reserved2026-01-21
2. Published2026-01-26
3. Modified2026-02-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-24123 is to upgrade to BentoML version 1.4.34 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing stricter file access controls on the BentoML build environment to limit the attacker's ability to read sensitive files. Additionally, carefully review any bentofile.yaml files from untrusted sources before building Bentos. Implement input validation on file paths used within the bentofile.yaml to prevent traversal attempts. Consider using a Web Application Firewall (WAF) or proxy to filter requests containing suspicious path patterns. After upgrading, confirm the fix by attempting to build a Bento with a bentofile.yaml containing a path traversal payload (e.g., ../sensitive_file.txt) and verifying that the file is not included in the resulting archive.