BentoML Dockerfile Injection Vulnerability Allows Arbitrary Build Instructions

BentoML contains a Dockerfile instruction injection vulnerability that enables attackers to add arbitrary build instructions to container images, according to the National Vulnerability Database. This flaw, identified as CVE-2026-112264, is rated High severity with a CVSS score of 8.5. It affects environments using BentoML version 1.4.39 or any earlier release. Security teams managing these deployments should assume that untrusted configuration inputs could lead to unintended execution during the containerization process.

Root cause

The vulnerability stems from how the legacy base.j2 template renders docker.env mapping keys, according to the NVD record. This template processing fails to properly sanitize input data containing newline characters. When these newlines are embedded within the mapping keys, they break the expected structure of the Dockerfile instructions. This allows the injection of additional, unauthorized commands into the build sequence. The weakness is categorized under CWE-78, which covers improper neutralization of special elements used in an OS command.

Attack path

An attacker must supply a crafted bentofile.yaml configuration file or an imported bento archive to trigger the exploit, per the NVD description. When the bentoml containerize command processes this malicious input, it executes the injected RUN instructions during the docker build phase. This execution happens within the build context, potentially granting access to build secrets that are otherwise protected. Furthermore, this capability allows an adversary to poison the resulting Docker image by modifying its contents or behavior before deployment.

Affected versions

• BentoML 1.4.39
• All previous versions of BentoML

Mitigation

• Review and sanitize all bentofile.yaml inputs for unexpected newline characters
• Validate the integrity of imported bento archives before processing
• Monitor container build logs for unauthorized RUN instruction execution
• Restrict access to build secrets during the containerization process

Detection notes

Security operations teams should monitor container build logs for unexpected or unauthorized RUN commands that were not part of the original build definition. Alerts should be configured to trigger when build scripts execute commands outside of predefined whitelists. Teams usually check for anomalous network connections or file modifications during the build phase, as these may indicate secret exfiltration or image tampering. First containment moves often involve halting the build pipeline and isolating the affected build environment to prevent further propagation of compromised images.

What to do and how to stay safe: BentoML

• Audit existing bentofile.yaml configurations for embedded newline characters in docker.env keys
• Implement input validation rules to reject YAML files with unexpected control characters
• Review build logs for any RUN instructions that were not explicitly defined by developers
• Monitor for unauthorized access attempts to build secrets during the containerization process

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-112264?

The CVSS score is 8.5, which is rated as High severity.

Which versions of BentoML are affected by this vulnerability?

BentoML versions up to and including 1.4.39 are affected by this Dockerfile injection flaw.

How can an attacker exploit this vulnerability?

Attackers can supply a crafted bentofile.yaml or imported bento archive to inject arbitrary build instructions.