CVE-2026-15035 bentoml CVE debrief

Who should care

Users of Bentoml OpenLLM 0.6.30 should be aware of this vulnerability and take necessary precautions to prevent exploitation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the impact on their systems and plan for mitigation.

Technical summary

The vulnerability is caused by improper handling of the cmd argument in the async_run_command function of Bentoml OpenLLM 0.6.30. This allows for command injection, which can be exploited by a local attacker. The CVSS score for this vulnerability is 1.9, indicating a low severity. The vulnerability affects the Model Repository Directory Name Handler component. Users of Bentoml OpenLLM 0.6.30 should be aware of this vulnerability and take necessary precautions to prevent exploitation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the impact on their systems and plan for mitigation. The exploit has been made public, and the project has been informed but has not yet responded. Evidence of exploitation is limited, and defenders should verify local access requirements and command injection risks.

Defensive priority

Low

Recommended defensive actions

• Inventory and verify OpenLLM 0.6.30 installations
• Implement compensating controls to restrict access to the Model Repository Directory
• Monitor for suspicious activity related to the async_run_command function
• Apply patches or updates when available
• Review and update asset inventory to ensure accurate tracking of affected systems
• Perform exposure review to identify potential attack vectors
• Track changes and updates to the vulnerability and related advisories

Evidence notes

The CVE record was published on 2026-07-08T14:16:56.643Z and last modified on 2026-07-09T15:54:06.390Z. The NVD entry is currently Analyzed. The vulnerability affects Bentoml OpenLLM 0.6.30, specifically the async_run_command function in src/openllm/common.py. Evidence of exploitation is limited, and defenders should verify local access requirements and command injection risks.

Official resources