CVE-2026-35044 bentoml CVE debrief

Who should care

Defenders responsible for systems using BentoML for AI app and model inference should assess exposure and prioritize upgrading to version 1.4.38 or later. Those allowing user-provided dockerfile templates in BentoML containerization should implement inventory checks and monitoring for suspicious activity.

Why it matters

CVE-2026-35044 is a high-severity vulnerability in BentoML that allows attacker-controlled code execution on the host machine. Defenders should prioritize upgrading to version 1.4.38 or later and assess systems for exposure.

• Arbitrary Python execution on host machine
• Bypassing of container isolation
• Potential for malicious code execution
• Need for verification of affected systems and remediation

Technical summary

The Dockerfile generation function generate_containerfile() in src/bentoml/_internal/container/generate.py uses an unsandboxed jinja2.Environment with the jinja2.ext.do extension to render user-provided dockerfile_template files. This allows attacker-controlled Jinja2 template code to execute arbitrary Python directly on the host machine, bypassing all container isolation, when a victim imports a malicious bento archive and runs bentoml containerize.

Defensive priority

Defenders should prioritize upgrading to BentoML version 1.4.38 or later to mitigate this vulnerability. Systems using BentoML for AI app and model inference should be assessed for exposure, particularly those allowing user-provided dockerfile templates. Inventory checks and monitoring for suspicious activity related to BentoML containerization should be implemented.

Recommended defensive actions

• Upgrade to BentoML version 1.4.38 or later
• Assess systems using BentoML for AI app and model inference for exposure
• Implement inventory checks and monitoring for suspicious activity related to BentoML containerization
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, its impact, and the fixed version. A vendor advisory is available on the GitHub security advisories page. The vulnerability allows attacker-controlled code execution on the host machine, bypassing container isolation. Defenders should verify affected systems, assess exposure, and prioritize upgrading to version 1.4.38 or later. Evidence from the CVE Program and NVD detail page supports this assessment. Limited source detail is provided; explicit and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.