BentoML: SSRF filter misses 100.64.0.0/10, so serving pods fetch from internal CGNAT hosts

Impact

BentoML's outbound-connection guard in _internal/utils/uri.py rejects private, loopback and link-local addresses but not the RFC 6598 shared range, so an unauthenticated caller who supplies a URL through multipart file handling (MultipartSerde.ensure_file) or JSON request parsing (JSONSerde.parse_request) makes the serving process issue requests into 100.64.0.0/10. That range is not exotic on this kind of fleet: Kubernetes installs frequently carve pod and service CIDRs out of 100.64/10, and CGNAT-addressed management endpoints exist in several cloud and colocation networks. The result is a model-serving endpoint - usually the most broadly exposed thing on a GPU node - acting as a probe or proxy into the cluster's own address space. This is an incomplete fix for CVE-2025-54381, so a deployment that patched for that one is still exposed.

Who can reach it

Network, unauthenticated. Anyone who can POST to a BentoML service endpoint that accepts a file or a JSON body. No credentials and no tenancy on the cluster are required.

What to do

Versions 1.4.19 through 1.4.39 are affected and the record names no fixed release - the upstream issue is open - so this is mitigate-only today. Deny egress from serving pods to 100.64.0.0/10 (and to everything else not explicitly required) with a NetworkPolicy or egress firewall, and reject user-supplied URLs at the gateway rather than relying on the in-process allowlist. When a fixed version ships, adopting it is a rolling restart of the serving deployment, not a node drain.

References

Related entries

• vLLM: DeepStream backend misclassification skips pixel limits and lets unauthenticated video exhaust GPU decodeCVE-2026-78684 · vLLM (DeepStream GPU decode path, pixel-limit enforcement)Medium
• llama.cpp RPC server: crafted tensor dimensions hit a reachable assertion and abort the processCVE-2026-86317 · llama.cpp RPC server (rpc_server::deserialize_tensor in ggml/src/ggml-rpc/ggml-rpc.cpp)Medium
• vLLM: audio extracted from video input ignores decode size and duration limitsCVE-2026-90554 · vLLM (NanoNemotronVL audio-from-video extraction, _extract_audio_from_videos)Medium
• vLLM: unvalidated MoRIIO ack fields let a remote client exhaust resources on a serving nodeCVE-2026-92220 · vLLM MoRIIO KV-transfer connector (acknowledgement handler)Medium
• vLLM: rejected prefill requests leak Mooncake transfer placeholders, stalling valid requestsCVE-2026-94625 · vLLM MooncakeConnector (KV transfer placeholder reclamation)Medium
• JupyterLab: language-pack Plural-Forms header reaches new Function, executing code in the session originCVE-2026-102830 · JupyterLab / JupyterLite (translation catalogue Plural-Forms parser)Medium