BentoML: SSRF filter misses 100.64.0.0/10, so serving pods fetch from internal CGNAT hosts

Impact

BentoML's outbound-connection guard in _internal/utils/uri.py rejects private, loopback and link-local addresses but not the RFC 6598 shared range, so an unauthenticated caller who supplies a URL through multipart file handling (MultipartSerde.ensure_file) or JSON request parsing (JSONSerde.parse_request) makes the serving process issue requests into 100.64.0.0/10. That range is not exotic on this kind of fleet: Kubernetes installs frequently carve pod and service CIDRs out of 100.64/10, and CGNAT-addressed management endpoints exist in several cloud and colocation networks. The result is a model-serving endpoint - usually the most broadly exposed thing on a GPU node - acting as a probe or proxy into the cluster's own address space. This is an incomplete fix for CVE-2025-54381, so a deployment that patched for that one is still exposed.

Who can reach it

Network, unauthenticated. Anyone who can POST to a BentoML service endpoint that accepts a file or a JSON body. No credentials and no tenancy on the cluster are required.

What to do

Versions 1.4.19 through 1.4.39 are affected and the record names no fixed release - the upstream issue is open - so this is mitigate-only today. Deny egress from serving pods to 100.64.0.0/10 (and to everything else not explicitly required) with a NetworkPolicy or egress firewall, and reject user-supplied URLs at the gateway rather than relying on the in-process allowlist. When a fixed version ships, adopting it is a rolling restart of the serving deployment, not a node drain.

References

Related entries

• ONNX: symlink-following external-data write lets a local attacker append to victim-writable filesCVE-2026-49114 · ONNX Python library (save_external_data external-data path handling)Medium
• Hugging Face Transformers: checkpoint index shard names traverse out of the model directoryCVE-2026-75104 · Hugging Face Transformers (checkpoint shard index filename handling)Medium
• Ollama: DNS rebinding grants a remote page full API accessCVE-2024-28224 · OllamaMedium
• Dagster (gRPC `get_notebook_data`): Local file inclusion — read arbitrary filesCVE-2025-51481 · Dagster (gRPC `get_notebook_data`)Medium
• llama.cpp (GGUF vocabulary parsing, llama_vocab::impl::print_info): MALICIOUS MODEL FILE CRASHES THE SERVER: the GGUFNCVD-2025-020-llama-cpp-gguf-vocabulary-parsin · llama.cpp (GGUF vocabulary parsing, llama_vocab::impl::print_info)Medium
• Kubeflow: SSRFCVE-2023-6570 · KubeflowMedium