CVE-2026-35044: BentoML SSTI in Dockerfile generation

CVE-2026-35044 · Severity: high · CVSS 8.8 · Published 2026-04-06

BentoML is a platform for building and deploying machine learning models. A security flaw allows an attacker to create a malicious model archive that, when imported and processed by a user, executes arbitrary code on the user's computer. This could lead to full system takeover, theft of sensitive data like API keys or source code, and unauthorized access to cloud environments.

Technologies: Bentoml, bentoml (PyPI). Vendors: BentoML, PyPI.

Quick answers

Is CVE-2026-35044 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35044 being exploited in the wild.
How severe is CVE-2026-35044?
High severity, with a CVSS score of 8.8, published 6 April 2026.
Which products and versions are affected?
bentoml (PyPI) <= 1.4.37, ECOSYSTEM:introduced=0,fixed=1.4.38.
Is there a fix for CVE-2026-35044?
Yes. bentoml (PyPI): upgrade to 1.4.38 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35044 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-35044?
Check whether you run Bentoml or bentoml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • bentoml (PyPI): upgrade to 1.4.38 or later
    pip install "bentoml>=1.4.38"

Technical details

The vulnerability is a Server-Side Template Injection (SSTI) in the `generate_containerfile()` function within `src/bentoml/_internal/container/generate.py`. It stems from the use of an unsandboxed `jinja2.Environment` configured with the dangerous `jinja2.ext.do` and `jinja2.ext.debug` extensions. An attacker can craft a malicious `dockerfile_template` inside a bento archive; when a victim runs `bentoml containerize` on this archive, the template is rendered on the host machine. Because the rendering occurs before Docker isolation is established, the attacker achieves arbitrary Python execution directly on the host OS. The issue is fixed in version 1.4.38 by migrating to `jinja2.sandbox.SandboxedEnvironment`.

Affected products

  • BentoML BentoML <= 1.4.37

Identifiers

  • CVE-2026-35044
  • GHSA-v959-cwq9-7hr6
  • PYSEC-2026-159

Timeline

  • 2026-04-02: disclosed
  • 2026-04-03: advisory
  • 2026-04-03: patched: Fixed in version 1.4.38

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.