# CVE-2026-112264: BentoML Dockerfile instruction injection in containerize

Source: https://junglewise.ai/threats/cve-2026-112264-bentoml-through-1-4-39-contains-a-dockerfile-instruction  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-112264 · Severity: high · CVSS 7.8 · Published 2026-10-19

BentoML is a framework that packages machine learning models into containers for deployment. A vulnerability in versions through 1.4.39 allows attackers to inject arbitrary Docker build commands by crafting malicious configuration files, potentially exposing build secrets and compromising container images during the build process.

Technologies: [Bentoml](https://junglewise.ai/threats/technologies/bentoml-bentoml). Vendors: [BentoML](https://junglewise.ai/threats/vendors/bentoml).

## Quick answers

**Is CVE-2026-112264 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112264 being exploited in the wild.

**How severe is CVE-2026-112264?** High severity, with a CVSS score of 7.8, published 19 October 2026.

**Which products and versions are affected?** Bentoml through 1.4.39.

**Is there a fix for CVE-2026-112264?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-112264 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-112264?** Check whether you run Bentoml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The legacy base.j2 template fails to properly sanitize docker.env mapping keys when rendering Dockerfiles, allowing newline injection. An attacker can supply a crafted bentofile.yaml or bento archive that, when processed by bentoml containerize, injects RUN instructions executed during docker build with full access to build-time secrets and the build context.

## Affected products

- BentoML BentoML through 1.4.39

## Timeline

- 2026-10-19: disclosed

## References

- [https://pypi.org/](https://pypi.org/)
- [https://github.com/bentoml/BentoML/blob/v1.4.39/src/bentoml/_internal/bento/build_config.py](https://github.com/bentoml/BentoML/blob/v1.4.39/src/bentoml/_internal/bento/build_config.py)

## Related threats

- [BentoML SSTI in Dockerfile generation](https://junglewise.ai/threats/cve-2026-35044-bentoml-ssti-in-dockerfile-generation)
- [BentoML command injection in cloud deployment setup script](https://junglewise.ai/threats/cve-2026-35043-bentoml-command-injection-in-cloud-deployment-setup-script)
- [BentoML command injection in bentofile.yaml system_packages](https://junglewise.ai/threats/cve-2026-33744-bentoml-command-injection-in-bentofile-yaml-system-packages)
- [PYSEC-2026-2398 - BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction](https://junglewise.ai/threats/cve-2026-27905-bentoml-vulnerable-to-arbitrary-file-write-via-symlink-path)