Database/AI/ML frameworks & serving
BentoML (runner server): Deserialization RCE on the internal runner server
CVE-2024-9070AI/ML frameworks & servingcurated
Impact
Deserialization RCE on the internal runner server
Who can reach it
Network to the runner port — reachable by a co-tenant in a flat cluster network
What to do
Upgrade past 1.3.4.post1; runner ports must be namespace-local
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.