CVE-2026-15035: BentoML OpenLLM RCE Vulnerability

CVE-2026-15035 Overview

CVE-2026-15035 is a command injection vulnerability in bentoml OpenLLM version 0.6.30. The flaw resides in the async_run_command function within src/openllm/common.py, which is part of the Model Repository Directory Name Handler component. An attacker with local access can manipulate the cmd argument to inject arbitrary operating system commands. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The exploit has been disclosed publicly, and the project maintainers had not responded to the initial issue report at the time of disclosure.

Critical Impact
Local attackers can inject arbitrary commands through the cmd argument of async_run_command, leading to unauthorized execution within the OpenLLM process context.

Affected Products

bentoml OpenLLM 0.6.30
src/openllm/common.py — async_run_command function
Model Repository Directory Name Handler component

Discovery Timeline

2026-07-08 - CVE CVE-2026-15035 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-15035

Vulnerability Analysis

The vulnerability exists in the async_run_command function located in src/openllm/common.py. This function handles asynchronous command execution, and its cmd argument is not properly neutralized before being passed to a downstream shell or command interpreter. When an attacker controls values that reach this argument, injected shell metacharacters are interpreted rather than treated as literal input.

The issue is reachable through the Model Repository Directory Name Handler, meaning attacker-controlled directory names can influence the constructed command. Exploitation requires local access and low privileges. Impact is limited to confidentiality, integrity, and availability within the local process context.

Root Cause

The root cause is improper input neutralization consistent with [CWE-74]. The async_run_command function accepts a cmd argument that is composed with attacker-influenced strings, such as model repository directory names, without sanitization or safe argument passing. Because the command is executed through a shell-interpreted pathway, characters such as ;, |, &, and backticks alter the intended command structure and allow injection.

Attack Vector

The attack vector is local. An attacker with local, authenticated access supplies a crafted model repository directory name that reaches the async_run_command function. When OpenLLM processes the repository, the injected payload is executed by the shell handling the command string. See the GitHub OpenLLM Issue #1229 and the proposed fix in GitHub OpenLLM Pull Request #1235 for technical context. No verified proof-of-concept code is reproduced here; refer to the VulDB CVE-2026-15035 entry for additional details.

Detection Methods for CVE-2026-15035

Indicators of Compromise

Unexpected child processes spawned by the OpenLLM Python runtime, particularly shells such as /bin/sh or /bin/bash invoked with concatenated arguments.
Model repository directory names that contain shell metacharacters such as ;, |, &, $(, or backticks.
Unexplained file creation, network connections, or command history entries originating from the OpenLLM process user.

Detection Strategies

Audit invocations of async_run_command in src/openllm/common.py and log the fully resolved cmd argument for review.
Monitor process ancestry to flag shell processes whose parent is the OpenLLM service.
Inspect model repository directory listings for names containing non-alphanumeric shell metacharacters.

Monitoring Recommendations

Enable command-line auditing on hosts running OpenLLM 0.6.30 to capture full argument strings.
Alert on file system events that create directories with suspicious names inside OpenLLM model repository paths.
Correlate OpenLLM process activity with outbound network connections to identify post-exploitation behavior.

How to Mitigate CVE-2026-15035

Immediate Actions Required

Restrict local access to systems running OpenLLM 0.6.30 to trusted administrative users only.
Remove or rename any existing model repository directories that contain shell metacharacters.
Run the OpenLLM process under a least-privileged, dedicated service account to constrain the blast radius of injection.

Patch Information

At publication, no vendor-released patch version is listed in the NVD entry. A remediation proposal is tracked in GitHub OpenLLM Pull Request #1235, which addresses the issue reported in GitHub OpenLLM Issue #1229. Monitor the GitHub OpenLLM Repository for a fixed release incorporating this change.

Workarounds

Validate model repository directory names against a strict allowlist of alphanumeric characters, dashes, and underscores before invoking OpenLLM operations.
Apply operating system controls such as AppArmor, SELinux, or seccomp to prevent the OpenLLM process from spawning shells.
Isolate OpenLLM within a container or virtual machine to contain the effects of local command injection.

bash

# Configuration example
# Reject repository directory names containing shell metacharacters
find /path/to/openllm/models -maxdepth 1 -type d \
  | grep -E '[;|&`$()<>\\\"'\''[:space:]]' \
  && echo 'Unsafe directory names detected - remediate before running OpenLLM'