CVE-2026-33744: BentoML RCE Vulnerability

CVE-2026-33744 Overview

CVE-2026-33744 is a command injection vulnerability affecting BentoML, a Python library for building online serving systems optimized for AI applications and model inference. Prior to version 1.4.37, the docker.system_packages field in bentofile.yaml accepts arbitrary strings that are interpolated directly into Dockerfile RUN commands without sanitization. Since system_packages is semantically a list of OS package names (data), users do not expect values to be interpreted as shell commands. A malicious bentofile.yaml achieves arbitrary command execution during bentoml containerize or docker build operations.

Critical Impact

Attackers can achieve arbitrary command execution during the container build process by crafting a malicious bentofile.yaml configuration file, potentially compromising build environments and CI/CD pipelines.

Affected Products

• BentoML versions prior to 1.4.37
• Applications using bentoml containerize functionality
• CI/CD pipelines that process untrusted bentofile.yaml configurations

Discovery Timeline

• 2026-03-27 - CVE-2026-33744 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-33744

Vulnerability Analysis

This vulnerability (CWE-94: Code Injection) arises from improper handling of user-supplied input in the BentoML containerization process. The docker.system_packages field in bentofile.yaml is designed to specify a list of operating system packages to be installed during the Docker image build. However, the values provided in this field are directly interpolated into Dockerfile RUN commands without proper sanitization or validation.

The fundamental issue is that BentoML treats what should be a simple data field (package names) as executable shell content. When a user or an automated process runs bentoml containerize, the library generates a Dockerfile where the system packages are passed directly to package manager commands. An attacker who can supply or modify a bentofile.yaml can inject arbitrary shell commands that execute during the container build process.

Root Cause

The root cause is insufficient input validation and the absence of sanitization when processing the docker.system_packages configuration values. The BentoML library directly concatenates these values into shell commands within the generated Dockerfile without escaping special characters or validating that the input contains only valid package names. This violates the principle of treating user input as data, not code.

Attack Vector

The attack requires local access where a user must be tricked into building a container from a malicious bentofile.yaml, or an attacker must have write access to the configuration file. The attack vector involves crafting a bentofile.yaml with malicious content in the docker.system_packages field. When the victim executes bentoml containerize or triggers a docker build that processes this configuration, the injected commands execute with the privileges of the build process.

For example, an attacker could include shell metacharacters and commands within a package name entry. When processed, these characters break out of the intended package installation command and execute arbitrary code. This is particularly dangerous in automated CI/CD environments that may process bentofile.yaml files from untrusted sources such as pull requests or external repositories. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-33744

Indicators of Compromise

• Unusual commands or shell metacharacters (;, |, $(), backticks) present in bentofile.yaml files
• Unexpected network connections or file system modifications during container build processes
• Build logs showing execution of commands unrelated to package installation
• Modified or suspicious bentofile.yaml files in repositories or shared storage

Detection Strategies

• Implement pre-build scanning of bentofile.yaml files for suspicious patterns in the docker.system_packages field
• Monitor build environments for unexpected process execution or network activity during containerization
• Use file integrity monitoring on bentofile.yaml configurations in production repositories
• Deploy static analysis tools to scan YAML configurations for injection patterns before builds

Monitoring Recommendations

• Enable comprehensive logging for all bentoml containerize operations and review for anomalies
• Monitor CI/CD pipeline activity for builds triggered by untrusted sources processing BentoML configurations
• Implement alerting for any build failures or unexpected behavior during containerization
• Track changes to bentofile.yaml files across all repositories using version control monitoring

How to Mitigate CVE-2026-33744

Immediate Actions Required

• Upgrade BentoML to version 1.4.37 or later immediately to address this vulnerability
• Audit all existing bentofile.yaml files for suspicious or unexpected content in the docker.system_packages field
• Review recent container builds for signs of compromise or unexpected command execution
• Restrict access to modify bentofile.yaml configurations in shared or CI/CD environments

Patch Information

Version 1.4.37 of BentoML includes a fix for this command injection vulnerability. Users should upgrade to this version or later to remediate the issue. The fix implements proper sanitization of the docker.system_packages field values before they are interpolated into Dockerfile commands. For complete details, see the GitHub Security Advisory GHSA-jfjg-vc52-wqvf.

Workarounds

• Validate all bentofile.yaml files manually before running bentoml containerize, ensuring docker.system_packages contains only valid package names
• Implement a pre-commit hook or CI/CD gate to scan for shell metacharacters in bentofile.yaml configuration fields
• Restrict the ability to modify bentofile.yaml files to trusted personnel only
• Consider building containers in isolated environments with limited network access and privileges until the patch is applied

# Upgrade BentoML to the patched version
pip install --upgrade bentoml>=1.4.37

# Verify the installed version
pip show bentoml | grep Version