CVE-2025-27520: BentoML RCE Vulnerability

CVE-2025-27520 Overview

CVE-2025-27520 is a critical Remote Code Execution (RCE) vulnerability caused by insecure deserialization in BentoML, a popular Python library for building online serving systems optimized for AI applications and model inference. The vulnerability exists in version 1.4.2 and allows any unauthenticated user to execute arbitrary code on the server through unsafe code handling in the serde.py module.

Critical Impact

Unauthenticated attackers can achieve complete remote code execution on BentoML servers, potentially compromising AI/ML infrastructure, stealing model data, and gaining full system access without any authentication requirements.

Affected Products

• BentoML versions prior to 1.4.3
• BentoML version 1.4.2 (specifically identified as vulnerable)
• All BentoML deployments using insecure deserialization in serde.py

Discovery Timeline

• 2025-04-04 - CVE-2025-27520 published to NVD
• 2025-06-27 - Last updated in NVD database

Technical Details for CVE-2025-27520

Vulnerability Analysis

This insecure deserialization vulnerability represents a severe security flaw in BentoML's data handling mechanisms. The vulnerability stems from unsafe code in the serde.py module, which is responsible for serialization and deserialization of data within the BentoML framework. When processing incoming data, the application fails to properly validate or sanitize serialized objects before deserializing them, allowing attackers to craft malicious payloads that execute arbitrary code upon deserialization.

The vulnerability is particularly dangerous in AI/ML serving environments where BentoML is commonly deployed, as these systems often handle sensitive model data and have network exposure to receive inference requests. The unauthenticated nature of this vulnerability means no credentials or special access is required to exploit it.

Root Cause

The root cause is classified as CWE-502 (Deserialization of Untrusted Data). The serde.py module contains unsafe deserialization logic that processes user-supplied data without proper validation. Python's native serialization mechanisms can be abused to execute arbitrary code when deserializing malicious objects, and the BentoML codebase did not implement adequate safeguards against such attacks.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can send specially crafted serialized payloads to a BentoML server endpoint. When the server deserializes this malicious data, it triggers the execution of attacker-controlled code with the privileges of the BentoML service process.

The security patch modifies how RemoteProxy handles media types to enforce safer data handling:

                 deployment_url, service=self.service, media_type="application/json"
             )
         else:
-            proxy = RemoteProxy("http://localhost:3000", service=self.service, app=app)
+            proxy = RemoteProxy("http://localhost:3000", service=self.service, app=app, media_type="application/json")
         self._service_instance.__self_proxy__ = proxy  # type: ignore[attr-defined]
         self._service_instance.to_async = proxy.to_async  # type: ignore[attr-defined]
         self._service_instance.to_sync = proxy.to_sync  # type: ignore[attr-defined]

Source: GitHub Commit b35f4f4

Detection Methods for CVE-2025-27520

Indicators of Compromise

• Unexpected outbound network connections from BentoML server processes
• Anomalous process spawning or command execution by the BentoML Python process
• Unusual serialized data patterns in incoming HTTP requests to BentoML endpoints
• New files or scripts appearing in the BentoML deployment directory
• Modifications to system files or credentials from the BentoML service account

Detection Strategies

• Monitor BentoML server logs for unusual request patterns or deserialization errors
• Implement network traffic analysis to detect malicious serialized Python objects (pickle payloads)
• Deploy endpoint detection and response (EDR) solutions to identify code execution anomalies
• Use SentinelOne Singularity to detect behavioral indicators of post-exploitation activity

Monitoring Recommendations

• Enable verbose logging on BentoML servers to capture request details
• Set up alerts for process creation events originating from Python/BentoML processes
• Monitor for unusual file system activity in BentoML installation directories
• Track network connections initiated by the BentoML service for C2 communication indicators

How to Mitigate CVE-2025-27520

Immediate Actions Required

• Upgrade BentoML to version 1.4.3 or later immediately
• Audit existing BentoML deployments to identify vulnerable versions (pip show bentoml)
• Implement network segmentation to limit exposure of BentoML services
• Review server logs for signs of exploitation attempts
• Consider temporarily disabling public-facing BentoML endpoints until patching is complete

Patch Information

The vulnerability is fixed in BentoML version 1.4.3. The security patch is available in commit b35f4f4fcc53a8c3fe8ed9c18a013fe0a728e194. Organizations should update their BentoML installations immediately using pip: pip install --upgrade bentoml>=1.4.3. For detailed patch information, refer to the GitHub Security Advisory GHSA-33xw-247w-6hmc.

Workarounds

• Restrict network access to BentoML servers using firewall rules or security groups
• Place BentoML deployments behind an authenticated reverse proxy or API gateway
• Implement input validation at the network edge to filter suspicious serialized payloads
• Use application-level authentication even if upgrading is not immediately possible

# Upgrade BentoML to patched version
pip install --upgrade bentoml>=1.4.3

# Verify installed version
pip show bentoml | grep Version

# Alternative: Pin to specific patched version
pip install bentoml==1.4.3