Is CVE-2026-35043 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35043 being exploited in the wild.

How severe is CVE-2026-35043?

High severity, with a CVSS score of 7.8, published 6 April 2026.

Which products and versions are affected?

bentoml (PyPI) <= 1.4.37, ECOSYSTEM:introduced=0,fixed=1.4.38.

Is there a fix for CVE-2026-35043?

Yes. bentoml (PyPI): upgrade to 1.4.38 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35043 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-35043?

Check whether you run Bentoml or bentoml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35043: BentoML command injection in cloud deployment setup script

Q: Which products and versions are affected?

bentoml (PyPI) <= 1.4.37, ECOSYSTEM:introduced=0,fixed=1.4.38.

Q: Is there a fix for CVE-2026-35043?

Yes. bentoml (PyPI): upgrade to 1.4.38 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-35043 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-35043?

Check whether you run Bentoml or bentoml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35043 · Severity: high · CVSS 7.8 · Published 2026-04-06

BentoML is a framework for building and deploying machine learning models. A vulnerability in its cloud deployment component allows an attacker to execute malicious commands on the cloud infrastructure used to build and package these models. This could lead to the theft of sensitive credentials, API keys, or other customer data stored within the build environment.

Technologies: Bentoml, bentoml (PyPI). Vendors: BentoML, PyPI.

Quick answers

Is CVE-2026-35043 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35043 being exploited in the wild.
How severe is CVE-2026-35043?: High severity, with a CVSS score of 7.8, published 6 April 2026.
Which products and versions are affected?: bentoml (PyPI) <= 1.4.37, ECOSYSTEM:introduced=0,fixed=1.4.38.
Is there a fix for CVE-2026-35043?: Yes. bentoml (PyPI): upgrade to 1.4.38 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35043 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-35043?: Check whether you run Bentoml or bentoml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

bentoml (PyPI): upgrade to 1.4.38 or later
```
pip install "bentoml>=1.4.38"
```

Technical details

An OS command injection vulnerability exists in `src/bentoml/_internal/cloud/deployment.py` due to improper neutralization of the `system_packages` field in `bentofile.yaml`. The `_build_setup_script` function uses an f-string to join and interpolate these package names directly into a shell command (`apt-get install`) without quoting or sanitization. An attacker can provide a malicious package name containing shell metacharacters (e.g., semicolons) to execute arbitrary commands. This script is subsequently uploaded to and executed on BentoCloud or enterprise Yatai/Kubernetes build nodes during the deployment process. The vulnerability was partially addressed in a previous commit but missed this specific cloud deployment path. A fix is available in version 1.4.38.

Affected products

BentoML bentoml <= 1.4.37

Identifiers

CVE-2026-35043
GHSA-fgv4-6jr3-jgfw
PYSEC-2026-158

Timeline

2026-03-24: other: Partial fix implemented in commit ce53491
2026-04-02: disclosed
2026-04-03: advisory
2026-04-06: other: NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.