CVE-2026-44345: BentoML: Dockerfile command injection via docker.base_image

Synopsis

This is a Dockerfile command injection vulnerability in BentoML, a Python library for building AI model serving systems. The flaw is reachable over the network and requires no authentication, but does require a victim to process a malicious bento.yaml file containing a crafted multi-line docker.base_image value. Successful exploitation causes BentoML to generate a Dockerfile with injected directives that execute arbitrary commands on the victim host when bentoml containerize runs docker build. A patched-image rebuild at version 1.4.39 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The malicious bento.yaml can be delivered to the victim over the network, so the attacker must be able to reach the victim through a network channel such as a shared repository, package feed, or direct file transfer.

• AuthenticationNot required

  No credentials or account privileges are needed; an unauthenticated attacker can craft and distribute the malicious bento.yaml without any prior access to the target system.

• Victim interactionRequired

  The victim must load and process the attacker-supplied bento.yaml by running bentoml containerize, making this a social-engineering vector where the attacker must persuade the victim to use the malicious configuration file.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the victim processes the file; no race conditions, memory layout knowledge, or special environmental factors are required.

Blast Radius

• The injected RUN directives execute arbitrary shell commands on the victim host under the permissions of the user running docker build, allowing full code execution in that context.
• An attacker reads files accessible to the build process, including secrets, credentials, or API keys mounted or available in the build environment.
• An attacker modifies or deletes files on the host filesystem within the scope of the build user's permissions.
• The build process can be weaponized to exfiltrate data, install persistent backdoors, or pivot to other services reachable from the build host.