CVE-2026-44346 BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml

What is CVE-2026-44346?

CVE-2026-44346 is a high-severity command injection vulnerability in BentoML, published on 27 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs[*].name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentoml containerize on the imported bento, those RUN directives execute on the host during docker build. This vulnerability is fixed in 1.4.39.

Weakness: CWE-94, CWE-78

Which versions are affected by CVE-2026-44346?

3 open source packages ship an affected version, including bentoml. It affects 1 product.

Products include Bentoml Bentoml.

How do I fix CVE-2026-44346?

Upgrade bentoml to 1.4.39 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-44346 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44346 exists.

Other vulnerabilities in BentoML

• CVE-2025-54381 BentoML is Vulnerable to an SSRF Attack Through File Upload Processing Critical 9.9
• CVE-2025-32375 Insecure Deserialization leads to RCE in BentoML's runner server Critical 9.8
• CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization Critical 9.8
• CVE-2026-44345 BentoML: Dockerfile command injection via docker.base_image High 8.8
• CVE-2026-35044 BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generation High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w2pm-x38x-jp44, PYSEC-2026-190.