CVE-2026-78205 Overview
CVE-2026-78205 is a Server-Side Request Forgery (SSRF) vulnerability in BentoML, an open-source model-serving framework. The make_safe_connect function in _internal/utils/uri.py blocks private, loopback, and link-local IP addresses but omits the RFC 6598 shared address space (100.64.0.0/10, used by Carrier-Grade NAT). Unauthenticated attackers can supply URLs pointing to CGNAT ranges through multipart file handling (MultipartSerde.ensure_file) or JSON request parsing (JSONSerde.parse_request). The server then issues outbound requests to internal hosts reachable via CGNAT networks. This is an incomplete fix for CVE-2025-54381 [CWE-918].
Critical Impact
Unauthenticated attackers can force BentoML servers to make outbound HTTP requests to internal CGNAT-reachable hosts, enabling reconnaissance and access to internal services.
Affected Products
- BentoML versions 1.4.19 through 1.4.39
- Deployments exposing MultipartSerde.ensure_file endpoints
- Deployments exposing JSONSerde.parse_request endpoints
Discovery Timeline
- 2026-08-24 - CVE-2026-78205 published to NVD
- 2026-08-24 - Last updated in NVD database
Technical Details for CVE-2026-78205
Vulnerability Analysis
BentoML's make_safe_connect function enforces an allowlist-by-exclusion model. It filters URLs whose resolved IP addresses fall within private (RFC 1918), loopback, or link-local ranges before allowing outbound HTTP connections. The filter does not account for RFC 6598 shared address space (100.64.0.0/10), which providers commonly deploy for Carrier-Grade NAT (CGNAT) and cloud metadata routing.
An unauthenticated attacker submits a request containing a URL whose hostname resolves into the CGNAT range. Because the safeguard omits this range, the server treats it as public and completes the outbound connection. The attacker uses the server as a proxy to reach internal services otherwise unreachable from the internet.
Two request paths trigger the connection. MultipartSerde.ensure_file fetches file inputs referenced by URL during multipart form processing. JSONSerde.parse_request performs equivalent URL resolution during JSON body parsing. Both invoke make_safe_connect and rely on its filter as the sole enforcement point.
Root Cause
The root cause is an incomplete IP-range blocklist. The safeguard checks against private, loopback, and link-local ranges but does not include RFC 6598 space. Organizations that route management interfaces, service meshes, or metadata endpoints through CGNAT addressing remain reachable through the BentoML server. This is an incomplete fix for CVE-2025-54381, where the original patch neglected the shared address space class.
Attack Vector
The attack requires no authentication and no user interaction. An attacker sends a crafted multipart or JSON request containing a URL that resolves into 100.64.0.0/10. The server initiates an outbound request to the attacker-specified internal host and returns response data or side-channel signals such as timing and error messages. The vulnerability enables reconnaissance of CGNAT-reachable services and, depending on the internal service response, secondary data exposure.
No verified proof-of-concept code is publicly available. Refer to the VulnCheck Advisory on BentoML and the BentoML URI source in v1.4.39 for the vulnerable code path.
Detection Methods for CVE-2026-78205
Indicators of Compromise
- Outbound HTTP or HTTPS connections from BentoML processes to destinations within 100.64.0.0/10.
- Multipart or JSON request bodies containing URL fields with hostnames resolving to CGNAT addresses.
- Application logs from MultipartSerde.ensure_file or JSONSerde.parse_request showing fetches against unusual IP ranges.
Detection Strategies
- Inspect BentoML request logs for URL-valued parameters and flag hostnames that resolve into 100.64.0.0/10.
- Monitor egress network telemetry from model-serving hosts for connections destined to CGNAT ranges that are not part of documented infrastructure.
- Correlate inbound API request patterns with subsequent outbound connections initiated by the BentoML process.
Monitoring Recommendations
- Deploy egress firewall logging that captures destination IPs from all BentoML worker processes.
- Alert on any BentoML-originated DNS resolution that returns an address within RFC 6598 space.
- Baseline normal outbound destinations for model-serving hosts and alert on deviations.
How to Mitigate CVE-2026-78205
Immediate Actions Required
- Identify all BentoML deployments running versions 1.4.19 through 1.4.39 and prioritize internet-exposed instances.
- Restrict outbound network access from BentoML hosts using egress firewall rules that deny 100.64.0.0/10 unless explicitly required.
- Place BentoML behind an authenticated reverse proxy to eliminate unauthenticated request paths.
Patch Information
Upgrade to a BentoML release later than 1.4.39 that includes RFC 6598 in the make_safe_connect blocklist. Track remediation status through BentoML Issue #5644 and the BentoML repository for release notes confirming the fix.
Workarounds
- Add network-layer egress rules that block outbound traffic from BentoML workers to 100.64.0.0/10 and other sensitive ranges.
- Front BentoML endpoints with a web application firewall that inspects request bodies and rejects URLs resolving to CGNAT space.
- Disable or gate endpoints that invoke MultipartSerde.ensure_file or JSONSerde.parse_request when URL-based inputs are not required.
# Example iptables egress rule blocking RFC 6598 CGNAT range
iptables -A OUTPUT -d 100.64.0.0/10 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
