CVE-2026-24123

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24123", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-21T18:38:22.473Z", "datePublished": "2026-01-26T22:14:39.709Z", "dateUpdated": "2026-01-27T21:37:03.727Z"}, "containers": {"cna": {"title": "BentoML has a Path Traversal via Bentofile Configuration", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/bentoml/BentoML/security/advisories/GHSA-6r62-w2q3-48hf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/bentoml/BentoML/security/advisories/GHSA-6r62-w2q3-48hf"}, {"name": "https://github.com/bentoml/BentoML/commit/84d08cfeb40c5f2ce71b3d3444bbaa0fb16b5ca4", "tags": ["x_refsource_MISC"], "url": "https://github.com/bentoml/BentoML/commit/84d08cfeb40c5f2ce71b3d3444bbaa0fb16b5ca4"}, {"name": "https://github.com/bentoml/BentoML/releases/tag/v1.4.34", "tags": ["x_refsource_MISC"], "url": "https://github.com/bentoml/BentoML/releases/tag/v1.4.34"}], "affected": [{"vendor": "bentoml", "product": "BentoML", "versions": [{"version": "< 1.4.34", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-26T22:14:39.709Z"}, "descriptions": [{"lang": "en", "value": "BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed. Version 1.4.34 contains a patch for the issue."}], "source": {"advisory": "GHSA-6r62-w2q3-48hf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T21:36:54.247534Z", "id": "CVE-2026-24123", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T21:37:03.727Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24123", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-27T21:36:54.247534Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T21:36:59.309Z"}}], "cna": {"title": "BentoML has a Path Traversal via Bentofile Configuration", "source": {"advisory": "GHSA-6r62-w2q3-48hf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "bentoml", "product": "BentoML", "versions": [{"status": "affected", "version": "< 1.4.34"}]}], "references": [{"url": "https://github.com/bentoml/BentoML/security/advisories/GHSA-6r62-w2q3-48hf", "name": "https://github.com/bentoml/BentoML/security/advisories/GHSA-6r62-w2q3-48hf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/bentoml/BentoML/commit/84d08cfeb40c5f2ce71b3d3444bbaa0fb16b5ca4", "name": "https://github.com/bentoml/BentoML/commit/84d08cfeb40c5f2ce71b3d3444bbaa0fb16b5ca4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/bentoml/BentoML/releases/tag/v1.4.34", "name": "https://github.com/bentoml/BentoML/releases/tag/v1.4.34", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed. Version 1.4.34 contains a patch for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-26T22:14:39.709Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24123", "state": "PUBLISHED", "dateUpdated": "2026-01-27T21:37:03.727Z", "dateReserved": "2026-01-21T18:38:22.473Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-26T22:14:39.709Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "BentoML", "vendor": "bentoml", "versions": [{"status": "affected", "version": "< 1.4.34"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bentoml:bentoml:*:*:*:*:*:*:*:*", "matchCriteriaId": "DE676E6B-09BB-4BB5-839C-CDA683332ADC", "versionEndExcluding": "1.4.34", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed. Version 1.4.34 contains a patch for the issue."}, {"lang": "es", "value": "BentoML es una librer\u00eda de Python para construir sistemas de servicio en l\u00ednea optimizados para aplicaciones de IA e inferencia de modelos. Antes de la versi\u00f3n 1.4.34, la configuraci\u00f3n `bentofile.yaml` de BentoML permite ataques de salto de ruta a trav\u00e9s de m\u00faltiples campos de ruta de archivo (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). Un atacante puede crear un bentofile malicioso que, cuando es construido por una v\u00edctima, exfiltra archivos arbitrarios del sistema de archivos al archivo bento. Esto permite ataques a la cadena de suministro donde archivos sensibles (claves SSH, credenciales, variables de entorno) son incrustados silenciosamente en los bentos y expuestos cuando se suben a registros o se despliegan. La versi\u00f3n 1.4.34 contiene un parche para el problema."}], "id": "CVE-2026-24123", "lastModified": "2026-06-17T10:22:39.940", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24123", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-27T21:36:54.247534Z", "version": "2.0.3"}}]}, "published": "2026-01-26T23:16:08.460", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/bentoml/BentoML/commit/84d08cfeb40c5f2ce71b3d3444bbaa0fb16b5ca4"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/bentoml/BentoML/releases/tag/v1.4.34"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/bentoml/BentoML/security/advisories/GHSA-6r62-w2q3-48hf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T14:58:55.397836+00:00", "value": {"mitigation_remediation": ["Upgrade BentoML to version 1.4.34 or later, which contains a patch that sanitizes file path inputs.", "Limit the build process to trusted or signed bentofile.yaml sources and validate file paths prior to initiating a build.", "Implement CI/CD checks or artifact scanning to detect unexpected embedded files in produced bentos before publishing to registries."], "summary": {"action": "Apply patch", "impact": "Unauthorized data exfiltration via path traversal"}, "threat_synthesis": {"affected_systems": "The issue affects BentoML installations using the bentoml Python library prior to version 1.4.34. The relevant product is BentoML, and the vulnerable releases are all versions before v1.4.34. Updating to the patched release eliminates the vulnerability.", "description_and_impact": "BentoML previously allowed users to specify several file path fields in its bentofile.yaml configuration, including description, docker.setup_script, docker.dockerfile_template, and conda.environment_yml. By inserting specially crafted paths, an attacker can cause the build process to read arbitrary files from the host file system and embed them into the resulting bento archive. This leads to hidden exfiltration of sensitive material such as SSH keys, credentials, or environment variables, and can silently inject malicious content into artifacts that are later pushed to registries or deployed in production. The vulnerability is a classic path traversal flaw (CWE\u201122) that compromises confidentiality and supply\u2011chain integrity. The impact is not limited to local files; any file the build process can read may be extracted, potentially exposing critical secrets.", "risk_and_exploitability": "The CVSS score of 7.4 denotes high severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no known exploitation campaigns. Attackers would need to supply a malicious bentofile.yaml to the build process, typically through supply\u2011chain contamination or a malicious user initiating a build. Once a victim builds the artifact, the path traversal is fully executed, reading arbitrary files into the archive, which can later propagate sensitive data when the artifact is pushed to a registry or deployed. Overall, the risk is significant for systems that build bentos from untrusted sources, but the probability of a real\u2011world attack remains low at present."}}}}, "created": "2026-01-27T09:03:14.926222+00:00", "updated": "2026-04-18T15:00:03.454662+00:00", "vendors": ["bentoml", "bentoml$PRODUCT$bentoml"]}