BentoML: newline in docker.env keys injects Dockerfile instructions during bentoml containerize

Impact

BentoML packages models into container images, so its build step is where a model artifact crosses into something a GPU fleet will run. Keys in the docker.env mapping are rendered into the legacy base.j2 template without escaping newlines, so a crafted bentofile.yaml or an imported bento archive can append arbitrary RUN instructions that execute during docker build. The attacker gets whatever the build host holds - build secrets passed to the builder, registry credentials, CI tokens - and can poison the resulting image so every node that later pulls it runs their code. This is the model-supply-chain path: accepting a bento from a tenant or a third party means handing them your build pipeline.

Who can reach it

Whoever supplies the bentofile.yaml or the imported bento archive that an operator then runs bentoml containerize against. No authentication to BentoML itself; it requires the victim to build an attacker-influenced bento, which is routine in a shared or automated build pipeline.

What to do

No fixed version is named in the record - it describes BentoML through 1.4.39 and the references point only at the vulnerable template and build code. Mitigate for now: treat every bentofile.yaml and imported bento as untrusted input, review docker.env keys before building, build only in a disposable runner that holds no long-lived registry or cloud credentials, and avoid passing build secrets to bento builds. No node maintenance needed; this is a CI/build-pipeline change.

References

Related entries

• Qdrant (`/logger`): Append to arbitrary files via the logger endpointCVE-2026-25628 · Qdrant (`/logger`)High
• llama.cpp llama-server: crafted sampler parameter triggers out-of-bounds read and unauthenticated crashCVE-2026-43628 · llama.cpp llama-server (DRY sampler, /v1/completions and /v1/chat/completions)High
• NVIDIA OpenShell Sandbox: path traversal bypasses L7 REST network policy, exposing blocked endpointsCVE-2026-65092 · NVIDIA OpenShell Sandbox for Linux (L7 REST network policy enforcement)High
• Darknet: integer overflow in convolutional layer sizing yields a heap overflow from a crafted .cfgCVE-2026-72852 · hank-ai/darknet convolutional layer (.cfg model definition parsing)High
• vLLM: remote processor code executes even when trust_remote_code is falseCVE-2026-90553 · vLLM (LlavaOnevision2 processor loader)High
• skops (`Card.get_model`): Model card loading has no trusted-types checkCVE-2025-54886 · skops (`Card.get_model`)High