CVE-2026-40610: BentoML information disclosure via symlink traversal in build context

Executive brief

BentoML is a platform for building and deploying machine learning models. A security flaw in its build process allows an attacker to trick the system into including sensitive files from the host machine (such as SSH keys or cloud credentials) into the final software package. This occurs if a user or automated system builds a project containing a malicious shortcut (symlink) provided by an attacker.

Technical details

A symlink traversal vulnerability exists in the `bentoml build` command. The vulnerable code uses `os.walk` and `shutil.copy` to package files into a Bento artifact without validating that the resolved source paths remain within the intended build context. An attacker can include a malicious symlink in a repository that points to sensitive files on the local filesystem (e.g., `/etc/shadow` or `~/.ssh/id_rsa`). When a developer or CI/CD system builds the repository, BentoML dereferences the symlink and copies the target file's contents into the artifact, which may then be exported or pushed to remote registries. This issue is fixed in version 1.4.39.

Affected products

• BentoML bentoml <= 1.4.38

Timeline

• 2026-05-07: disclosed
• 2026-05-07: advisory
• 2026-05-07: patched: Fixed in version 1.4.39

References

• https://api.github.com/users/larlarua
• https://github.com/larlarua
• https://api.github.com/users/larlarua/gists%7B/gist_id%7D
• https://api.github.com/users/larlarua/repos
• https://avatars.githubusercontent.com/u/90000267?v=4
• https://api.github.com/users/larlarua/events%7B/privacy%7D