Vulnerability · Published Oct 19, 2026 · Assigned by VulnCheck

CVE-2026-112264BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys

High 7.8

In plain English

A high-severity OS command injection in BentoML from bentoml. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 87.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.

Affected products (as reported)

Vendor	Product	Versions
bentoml	BentoML	0 – through 1.4.39

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/geo-chen/oss/blob/main/BentoML.md third-party-advisory
https://github.com/bentoml/BentoML/blob/v1.4.39/src/bentoml/_internal/container/frontend/dockerfile/templates/base.j2 technical-description
https://github.com/bentoml/BentoML/blob/v1.4.39/src/bentoml/_internal/bento/build_config.py technical-description
https://github.com/bentoml/BentoML/blob/v1.4.39/src/bentoml/_internal/container/generate.py technical-description
https://github.com/bentoml/BentoML/blob/v1.4.39/src/bentoml/_internal/container/__init__.py technical-description
VulnCheck Advisory: BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys third-party-advisory