CVE-2026-78205 bentoml CVE debrief

Who should care

Defenders responsible for BentoML deployments, especially those exposed to untrusted inputs, should assess their exposure and take immediate action to restrict outbound connections and monitor for suspicious activity.

Why it matters

CVE-2026-78205 is a medium-severity SSRF vulnerability in BentoML that allows unauthenticated attackers to make servers perform requests to internal hosts within CGNAT networks. Defenders should verify exposure, restrict outbound connections, and monitor for suspicious activity.

• Potential unauthorized access to internal hosts within CGNAT networks
• Possible data breaches through SSRF attacks
• Need for verification of BentoML version and exposure to untrusted inputs
• Requirement for compensating controls to limit SSRF impact

Technical summary

The BentoML framework does not properly restrict outbound connections, allowing unauthenticated attackers to perform SSRF attacks by supplying URLs pointing to the RFC 6598 shared address space (100.64.0.0/10) via multipart file handling or JSON request parsing. This affects versions 1.4.19 through 1.4.39. The vulnerability arises from the framework's incomplete safeguard against outbound connections to private IP addresses, specifically allowing requests to the RFC 6598 shared address space (100.64.0.0/10). This oversight enables unauthenticated attackers to make the server perform requests to internal hosts within CGNAT networks, potentially leading to unauthorized access, data breaches, or other security -

Defensive priority

Defenders should prioritize verifying exposure of BentoML deployments to untrusted inputs, especially those handling multipart file uploads or JSON requests. Immediate actions include reviewing and restricting outbound connections, applying compensating controls, and monitoring for suspicious activity.

Recommended defensive actions

• Verify BentoML version and assess exposure to untrusted inputs
• Restrict outbound connections to necessary services only
• Monitor for suspicious activity related to multipart file handling and JSON request parsing
• Apply compensating controls such as firewalls or network access controls to limit SSRF impact
• Review and update network access controls to prevent unauthorized access
• Perform regular security audits to identify potential vulnerabilities
• Implement additional monitoring and logging to detect potential SSRF attacks

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and references to source code and advisory information. However, specific details about exploitation, victim impact, or comprehensive remediation steps are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.