Is CVE-2026-40610 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40610 being exploited in the wild.

How severe is CVE-2026-40610?

Medium severity, with a CVSS score of 5.5, published 22 May 2026.

Which products and versions are affected?

bentoml (PyPI) <= 1.4.38, ECOSYSTEM:introduced=0,fixed=1.4.39.

Is there a fix for CVE-2026-40610?

Yes. bentoml (PyPI): upgrade to 1.4.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40610 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-40610?

Check whether you run bentoml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40610: BentoML information disclosure via symlink traversal in build context

Q: Which products and versions are affected?

bentoml (PyPI) <= 1.4.38, ECOSYSTEM:introduced=0,fixed=1.4.39.

Q: Is there a fix for CVE-2026-40610?

Yes. bentoml (PyPI): upgrade to 1.4.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-40610 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-40610?

Check whether you run bentoml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40610 · Severity: medium · CVSS 5.5 · Published 2026-05-22

BentoML is a platform for building and deploying machine learning models. A security flaw in its build process allows an attacker to trick the system into including sensitive files from the host machine (such as SSH keys or cloud credentials) into the final software package. This occurs if a user or automated system builds a project containing a malicious shortcut (symlink) provided by an attacker.

Technologies: bentoml (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-40610 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40610 being exploited in the wild.
How severe is CVE-2026-40610?: Medium severity, with a CVSS score of 5.5, published 22 May 2026.
Which products and versions are affected?: bentoml (PyPI) <= 1.4.38, ECOSYSTEM:introduced=0,fixed=1.4.39.
Is there a fix for CVE-2026-40610?: Yes. bentoml (PyPI): upgrade to 1.4.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40610 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-40610?: Check whether you run bentoml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

bentoml (PyPI): upgrade to 1.4.39 or later
```
pip install "bentoml>=1.4.39"
```

Technical details

A symlink traversal vulnerability exists in the `bentoml build` command. The vulnerable code uses `os.walk` and `shutil.copy` to package files into a Bento artifact without validating that the resolved source paths remain within the intended build context. An attacker can include a malicious symlink in a repository that points to sensitive files on the local filesystem (e.g., `/etc/shadow` or `~/.ssh/id_rsa`). When a developer or CI/CD system builds the repository, BentoML dereferences the symlink and copies the target file's contents into the artifact, which may then be exported or pushed to remote registries. This issue is fixed in version 1.4.39.

Affected products

BentoML bentoml <= 1.4.38

Identifiers

CVE-2026-40610
GHSA-mcfx-4vc6-qgxv
PYSEC-2026-2399

Timeline

2026-05-07: disclosed
2026-05-07: advisory
2026-05-07: patched: Fixed in version 1.4.39

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.