Path Traversal Vulnerability in BentoML AI Model Serving Library

CVE-2026-24123

What is CVE-2026-24123?

BentoML, a popular Python library for building AI application serving systems, is susceptible to a path traversal vulnerability. This flaw arises from the configuration settings in bentofile.yaml, which allows attackers to manipulate file paths via several fields, potentially leading to the exfiltration of sensitive files from the host's filesystem. With a crafted bentofile, attackers could covertly incorporate private information such as SSH keys or environment variables into a bento archive. When this malicious content is built and subsequently deployed, it risks exposure when registered in public repositories. The issue has been addressed in version 1.4.34, where a patch has been implemented to mitigate the risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References