CVE-2026-44346: BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml

Synopsis

A command injection vulnerability in BentoML (Python library for AI model serving) allows an attacker to embed malicious shell commands inside a crafted bentofile.yaml file. Because BentoML writes environment variable names from that file directly into generated Dockerfiles without sanitizing newline characters, a poisoned bentofile.yaml produces unquoted RUN directives that execute arbitrary commands on the host machine when the victim runs bentoml containerize. Successful exploitation gives the attacker code execution on the build host, with full read, write, and availability impact. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver a malicious bentofile.yaml to the victim over the network, making network reachability a prerequisite for the social-engineering step that triggers the build.

• AuthenticationNot required

  No account or credentials are needed; the attacker only needs to get the victim to import and containerize a crafted bento artifact.

• Victim interactionRequired

  The victim must explicitly run bentoml containerize on the imported malicious bento, meaning the attacker must persuade them to do so through phishing, a supply-chain substitution, or a similarly deceptive method.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim runs the containerize command; no race conditions or special memory layout are involved.

Blast Radius

• The attacker executes arbitrary shell commands on the host machine during the docker build process.
• Sensitive files, credentials, environment variables, and secrets accessible on the build host are exposed to the attacker.
• The attacker can write or modify files on the build host, including injecting backdoors into the resulting container image.
• The build process itself can be crashed or corrupted, disrupting CI/CD pipelines and image delivery workflows.