CVE-2025-27520: BentoML RCE Vulnerability

CVE-2025-27520 Overview

CVE-2025-27520 is a critical Remote Code Execution (RCE) vulnerability caused by insecure deserialization in BentoML, a popular Python library for building online serving systems optimized for AI applications and model inference. The vulnerability exists in version 1.4.2 and allows any unauthenticated user to execute arbitrary code on the server through unsafe code handling in the serde.py module.

Critical Impact
Unauthenticated attackers can achieve complete remote code execution on BentoML servers, potentially compromising AI/ML infrastructure, stealing model data, and gaining full system access without any authentication requirements.

Affected Products

BentoML versions prior to 1.4.3
BentoML version 1.4.2 (specifically identified as vulnerable)
All BentoML deployments using insecure deserialization in serde.py

Discovery Timeline

2025-04-04 - CVE-2025-27520 published to NVD
2025-06-27 - Last updated in NVD database

Technical Details for CVE-2025-27520

Vulnerability Analysis

This insecure deserialization vulnerability represents a severe security flaw in BentoML's data handling mechanisms. The vulnerability stems from unsafe code in the serde.py module, which is responsible for serialization and deserialization of data within the BentoML framework. When processing incoming data, the application fails to properly validate or sanitize serialized objects before deserializing them, allowing attackers to craft malicious payloads that execute arbitrary code upon deserialization.

The vulnerability is particularly dangerous in AI/ML serving environments where BentoML is commonly deployed, as these systems often handle sensitive model data and have network exposure to receive inference requests. The unauthenticated nature of this vulnerability means no credentials or special access is required to exploit it.

Root Cause

The root cause is classified as CWE-502 (Deserialization of Untrusted Data). The serde.py module contains unsafe deserialization logic that processes user-supplied data without proper validation. Python's native serialization mechanisms can be abused to execute arbitrary code when deserializing malicious objects, and the BentoML codebase did not implement adequate safeguards against such attacks.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can send specially crafted serialized payloads to a BentoML server endpoint. When the server deserializes this malicious data, it triggers the execution of attacker-controlled code with the privileges of the BentoML service process.

The security patch modifies how RemoteProxy handles media types to enforce safer data handling:

python

                 deployment_url, service=self.service, media_type="application/json"
             )
         else:
-            proxy = RemoteProxy("http://localhost:3000", service=self.service, app=app)
+            proxy = RemoteProxy("http://localhost:3000", service=self.service, app=app, media_type="application/json")
         self._service_instance.__self_proxy__ = proxy  # type: ignore[attr-defined]
         self._service_instance.to_async = proxy.to_async  # type: ignore[attr-defined]
         self._service_instance.to_sync = proxy.to_sync  # type: ignore[attr-defined]

Source: GitHub Commit b35f4f4

Detection Methods for CVE-2025-27520

Indicators of Compromise

Unexpected outbound network connections from BentoML server processes
Anomalous process spawning or command execution by the BentoML Python process
Unusual serialized data patterns in incoming HTTP requests to BentoML endpoints
New files or scripts appearing in the BentoML deployment directory
Modifications to system files or credentials from the BentoML service account

Detection Strategies

Monitor BentoML server logs for unusual request patterns or deserialization errors
Implement network traffic analysis to detect malicious serialized Python objects (pickle payloads)
Deploy endpoint detection and response (EDR) solutions to identify code execution anomalies
Use SentinelOne Singularity to detect behavioral indicators of post-exploitation activity

Monitoring Recommendations

Enable verbose logging on BentoML servers to capture request details
Set up alerts for process creation events originating from Python/BentoML processes
Monitor for unusual file system activity in BentoML installation directories
Track network connections initiated by the BentoML service for C2 communication indicators

How to Mitigate CVE-2025-27520

Immediate Actions Required

Upgrade BentoML to version 1.4.3 or later immediately
Audit existing BentoML deployments to identify vulnerable versions (pip show bentoml)
Implement network segmentation to limit exposure of BentoML services
Review server logs for signs of exploitation attempts
Consider temporarily disabling public-facing BentoML endpoints until patching is complete

Patch Information

The vulnerability is fixed in BentoML version 1.4.3. The security patch is available in commit b35f4f4fcc53a8c3fe8ed9c18a013fe0a728e194. Organizations should update their BentoML installations immediately using pip: pip install --upgrade bentoml>=1.4.3. For detailed patch information, refer to the GitHub Security Advisory GHSA-33xw-247w-6hmc.

Workarounds

Restrict network access to BentoML servers using firewall rules or security groups
Place BentoML deployments behind an authenticated reverse proxy or API gateway
Implement input validation at the network edge to filter suspicious serialized payloads
Use application-level authentication even if upgrading is not immediately possible

bash

# Upgrade BentoML to patched version
pip install --upgrade bentoml>=1.4.3

# Verify installed version
pip show bentoml | grep Version

# Alternative: Pin to specific patched version
pip install bentoml==1.4.3