{"id":"CVE-2026-112264","kind":"vulnerability","aliases":["CVE-2026-112264"],"related":[],"title":"BentoML: Dockerfile newline injection runs attacker build commands during containerize","description":"BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.","summary":"BentoML through 1.4.39 renders docker.env keys into a Dockerfile without escaping newlines, so a crafted bentofile.yaml or imported bento archive can inject RUN instructions. When bentoml containerize runs docker build, the injected commands execute, letting an attacker reach build secrets and poison the resulting image.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"bentoml","fixed":[],"affected":"<= 1.4.39","ecosystem":"PyPI"}],"ecosystems":[],"tags":["bentoml","build-host","docker","ml-serving","package","python","supply-chain"],"not_affected_if":["bentofiles-written-in-house","list-form-env","no-containerize","no-untrusted-bento-archives","trusted-bentofile-only"],"how_to_check":"1. Run 'pip show bentoml'. 1.4.39 and earlier are affected; 1.4.40 is not confirmed fixed. 2. Grep bentofile.yaml files and imported bento archives for a docker.env written as a mapping (key: value) rather than a list. Keys containing a newline are the attack. 3. The legacy base.j2 template is used when docker.base_image is set. 4. Read the generated Dockerfile before docker build and look for unexpected RUN lines.","fix":"No confirmed fixed release. Latest is 1.4.40 and its notes do not mention this issue; the candidate fix (PR #5700) was closed unmerged by its author, issue #5656 is still open. Until the maintainers confirm: do not run bentoml containerize on bentofile.yaml or bento archives from untrusted sources, and review docker.env.","status":"open","published_at":"2026-10-19T14:17:03+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:00:32+00:00","updated_at":"2026-10-25T03:41:39+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-25T03:00:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"BentoML: Dockerfile newline injection runs attacker build commands during containerize","impact":"high","summary":"BentoML through 1.4.39 renders docker.env keys into a Dockerfile without escaping newlines, so a crafted bentofile.yaml or imported bento archive can inject RUN instructions. When bentoml containerize runs docker build, the injected commands execute, letting an attacker reach build secrets and poison the resulting image.","category":"package","nicknames":[],"who_cares":["bentoml","python","ml-serving","docker"],"confidence":0.6,"needs_auth":"no","worst_case":"attacker runs commands during image build and poisons the image","analyst_note":"Check the NVD entry and BentoML GitHub advisory for the fixed version and whether the attack needs a user to run containerize on an attacker-supplied archive.","how_to_check":"- Run `bentoml --version` and compare against 1.4.39 or earlier\n- Check whether any bentofile.yaml or imported bento archive you build from comes from an untrusted source\n- Look for a `docker.env` section in bentofile.yaml files and check whether its keys contain newlines","needs_analyst":true,"not_affected_if":["bentofiles-written-in-house","no-untrusted-bento-archives"],"who_is_affected":"Teams that run `bentoml containerize` on bentofile.yaml files or bento archives they did not write themselves, such as community models or files pulled from shared storage. Teams that only build from their own reviewed bentofiles with no untrusted docker.env keys are less exposed, though the sources do not state a patched version.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000638,"input_tokens":3363,"output_tokens":603,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and BentoML GitHub advisory for the fixed version and whether the attack needs a user to run containerize on an attacker-supplied archive.","search":"'-112264':13A,16A '-2026':12A,15A '1.4.39':33B,78C 'access':127C 'add':89C 'allow':86C 'arbitrari':90C 'archiv':50B,115C 'attack':6A,67B,87C,106C 'base.j2':104C 'bento':49B,114C 'bentofile.yaml':46B,111C 'bentoml':1A,17A,18B,31B,56B,76C,118C 'build':7A,20B,60B,69B,91C,126C,128C 'build-host':19B 'chain':30B 'command':8A,63B 'contain':79C 'container':10A,57B,119C 'craft':45B,110C 'cve':11A,14A 'docker':22B,59B,125C 'docker.env':35B,97C 'dockerfil':2A,39B,81C 'embed':94C 'escap':41B 'execut':64B,120C 'host':21B 'imag':75B,132C 'import':48B,113C 'inject':4A,52B,62B,83C,121C 'instruct':54B,82C,92C,123C 'key':36B,99C 'legaci':103C 'let':65B 'map':98C 'ml':24B 'ml-serv':23B 'newlin':3A,42B,95C 'packag':26B 'poison':72B,131C 'python':27B 'reach':68B 'render':34B,100C 'result':74B 'run':5A,53B,58B,122C 'secret':70B,129C 'serv':25B 'suppli':29B,108C 'supply-chain':28B 'templat':105C 'vulner':84C 'without':40B","nicknames":[],"mitigations":[],"who_affected":"Teams that run `bentoml containerize` on bentofile.yaml files or bento archives they did not write themselves, such as community models or files pulled from shared storage. Teams that only build from their own reviewed bentofiles with no untrusted docker.env keys are less exposed, though the sources do not state a patched version.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-112264","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112264","severity":null,"published_at":"2026-10-19T14:17:03+00:00","modified_at":"2026-10-19T21:13:39+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112264:769","url":null,"severity":null,"published_at":"2026-10-25T03:41:39+00:00","modified_at":"2026-10-25T03:41:39+00:00","first_seen_at":"2026-10-25T03:41:39+00:00","fetched_at":"2026-10-25T03:41:39+00:00","note":"Read VulnCheck advisory (CNA), reporter's PoC writeup, BentoML issue #5656, v1.4.40 release notes. No vendor GHSA for this CVE; reporter got no response. No confirmed fixed version: 1.4.40 (2026-10-23) notes don't mention it; PR #5700 was closed by its author. Public PoC exists; no exploitation reported. Nothing marked verified (no vendor/maintainer statement of fix)."}],"documents":[{"id":3292,"url":"https://www.vulncheck.com/advisories/bentoml-through-1.4.39-dockerfile-instruction-injection-via-docker-env-keys","title":"VulnCheck: BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3293,"url":"https://github.com/geo-chen/oss/blob/main/BentoML.md","title":"George Chen report and PoC: docker.env dict key injection in base.j2","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3294,"url":"https://github.com/bentoml/BentoML/issues/5656","title":"BentoML #5656: Dockerfile injection via unsanitized docker.env dict values (open)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":3295,"url":"https://github.com/bentoml/BentoML/releases/tag/v1.4.40","title":"BentoML v1.4.40 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}