CVE-2026-35043 bentoml CVE debrief

Who should care

Defenders responsible for cloud deployments using BentoML, especially those in environments where AI apps and model inference are critical, should prioritize patching or mitigating this vulnerability.

Why it matters

CVE-2026-35043 is a high-severity vulnerability in BentoML that allows for RCE on the CI/CD tier. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where BentoML is used for cloud deployments.

• Potential RCE on CI/CD tier requires immediate patching or mitigation
• High CVSS score of 7.8 indicates significant vulnerability
• Fix in version 1.4.38 provides clear remediation path

Technical summary

The vulnerability is caused by the interpolation of `system_packages` directly into a shell command using an f-string without any quoting in the `src/bentoml/_internal/cloud/deployment.py` file. This allows for RCE on the CI/CD tier. The issue is fixed in version 1.4.38. Affected product deployments using BentoML should be reviewed for potential exposure, and defenders should prioritize patching or mitigating this vulnerability, especially in environments where BentoML is used for cloud deployments. The vulnerability's high CVSS score of 7.8 and its potential for RCE on the CI/CD tier make it a critical issue to address.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where BentoML is used for cloud deployments. The vulnerability's high CVSS score of 7.8 and its potential for RCE on the CI/CD tier make it a critical issue to address.

Recommended defensive actions

• Patch BentoML to version 1.4.38 or later
• Review and restrict usage of system_packages in cloud deployment scripts
• Monitor for suspicious activity in CI/CD pipelines
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed by the CVE Program and NVD records. The source reference from GitHub provides additional details on the vulnerability and its fix. However, the exact scope of affected systems and potential exploitation attempts remain unknown.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.