Key points
- CVE-2026-112264 affects BentoML versions through 1.4.39 with a CVSS score of 8.5.
- The flaw allows arbitrary Docker build instruction injection via the legacy base.j2 template.
- Attackers can execute injected RUN commands to access secrets and poison images during containerization.
BentoML versions up to and including 1.4.39 contain a high-severity security vulnerability identified as CVE-2026-112264. The National Vulnerability Database rates this flaw with a CVSS score of 8.5. The issue stems from a Dockerfile instruction injection weakness, classified under CWE-78. This vulnerability exists within the software’s handling of Docker build processes, specifically involving the legacy base.j2 template used for rendering configurations.
In plain English
The vulnerability allows an attacker to insert unauthorized commands into the Docker build process. By embedding newlines within keys in the docker.env mapping, an attacker can bypass intended constraints. This manipulation tricks the system into executing arbitrary build instructions that were not part of the original design. The flaw is triggered when the system processes these specific environmental mappings during the container creation phase.
The background
According to the NVD record, attackers can exploit this issue by supplying a crafted bentofile.yaml file or importing a malicious bento archive. When the bentoml containerize command runs, it executes these injected RUN instructions during the docker build stage. This execution happens before the final image is sealed, giving the attacker a window to interact with the build environment and manipulate the resulting container image directly.
What changes now
The primary risk involves the exposure of build secrets and the poisoning of container images. Because the injected instructions run during the build, attackers can potentially read sensitive credentials stored in the build environment. They can also alter the contents of the resulting Docker image, embedding malicious code or backdoors. This compromises the integrity of any application packaged using the affected versions of BentoML, affecting the trust chain for deployed services.
Who needs to act first
Teams should prioritize updating systems that are exposed to untrusted inputs or external users. Organizations using BentoML for public-facing applications or handling third-party archives should verify their current version immediately. It is advisable to test updates in a staging environment before rolling them out to production to ensure compatibility. If an immediate update is not possible, restrict access to the containerization process and monitor for unusual build activities or unexpected changes in container images.
What to do and how to stay safe: BentoML
- Check all servers and development environments to identify if BentoML versions 1.4.39 or older are installed.
- Review recent build logs for any unexpected RUN commands or anomalies in the docker build process.
- Restrict the source of bentofile.yaml files and imported bento archives to trusted, verified channels only.
- Monitor container images for integrity changes after the build process completes to detect potential poisoning.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of BentoML are affected by CVE-2026-112264?
All versions of BentoML up to and including 1.4.39 are affected by this vulnerability.
What is the CVSS score for this vulnerability?
The CVSS score for CVE-2026-112264 is 8.5, which is rated as High severity.
How do attackers exploit this Dockerfile injection flaw?
Attackers exploit the flaw by supplying crafted bentofile.yaml files or imported bento archives that inject newlines into docker.env mapping keys.
