CVE-2026-32286 vulnerabilities

Vulnerabilities for packages: bento, telegraf, splunk-otel-collector, grafana-alloy, steampipe, kots...

GHSA-JQCQ-XJH3-6G23 vulnerabilities

Vulnerabilities for packages: bento, telegraf, splunk-otel-collector, grafana-alloy, steampipe, kots...

CVE-2026-4427 vulnerabilities

Vulnerabilities for packages: flyte, harbor, migrate, teleport, bento, trillian, telegraf, src, splunk-otel-collector, hydra, grafana-alloy, steampipe, kots...

GHSA-X6GF-MPR2-68H6 vulnerabilities

Vulnerabilities for packages: flyte, harbor, migrate, teleport, bento, trillian, telegraf, src, splunk-otel-collector, hydra, grafana-alloy, steampipe, kots...

GHSA-JQCQ-XJH3-6G23 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, splunk-otel-collector-fips, bento, grafana-alloy, steampipe, bento-fips, teleport, grafana-alloy-fips, kots, telegraf...

GHSA-X6GF-MPR2-68H6 vulnerabilities

Vulnerabilities for packages: flyte, splunk-otel-collector, harbor, splunk-otel-collector-fips, trillian-fips, src, bento-fips, argo-workflows-fips, ory-kratos, gotrue, bento, hydra, vault-fips, argo-workflows, kots, harbor-fips, teleport, trillian, wavefront-collector-for-kubernetes, hydra-fips,...

CVE-2026-4427 vulnerabilities

Vulnerabilities for packages: flyte, splunk-otel-collector, harbor, splunk-otel-collector-fips, trillian-fips, src, bento-fips, argo-workflows-fips, ory-kratos, gotrue, bento, hydra, vault-fips, argo-workflows, kots, harbor-fips, teleport, trillian, wavefront-collector-for-kubernetes, hydra-fips,...

CVE-2026-33744

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the docker.systempackages field in bentofile.yaml accepts arbitrary strings that are interpolated directly into Dockerfile RUN commands without sanitization. Since...

PT-2026-28523

Name of the Vulnerable Software and Affected Versions BentoML versions prior to 1.4.37 Description BentoML is a Python library used for building online serving systems for AI applications and model inference. A flaw exists where the docker.system packages field within the bentofile.yaml file does...

CVE-2026-27905 BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.36, the safeextracttarfile function validates that each tar member's path is within the destination directory, but for symlink members it only validates the symlink's own path,...

BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction

Arbitrary File Write via Symlink Path Traversal in Tar Extraction Summary The safeextracttarfile function validates that each tar member's path is within the destination directory, but for symlink members it only validates the symlink's own path, not the symlink's target. An attacker can create a...

CVE-2026-24123

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate,...

EUVD-2026-4723

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate,...

CVE-2026-24123

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate,...

GHSA-6R62-W2Q3-48HF BentoML has a Path Traversal via Bentofile Configuration

Summary BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate, conda.environmentyml. An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files fr...

BentoML path traversal vulnerability

BentoML is an open-source model service library developed by BentoML. It is used to build high-performance and scalable artificial intelligence applications using Python. Versions of BentoML prior to 1.4.34 contained a path traversal vulnerability. This vulnerability stemmed from the bentofile.ya...

CVE-2025-63811 vulnerabilities

Vulnerabilities for packages: argo-events, jitsucom-bulker, bento, opentelemetry-collector-contrib, sqlexporter, amazon-cloudwatch-agent, splunk-otel-collector, grafana-alloy, cluster-api-aws-controller...

GHSA-9MJ6-HXHV-W67J vulnerabilities

Vulnerabilities for packages: argo-events, jitsucom-bulker, bento, opentelemetry-collector-contrib, sqlexporter, amazon-cloudwatch-agent, splunk-otel-collector, grafana-alloy, cluster-api-aws-controller...

CVE-2025-63811 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, splunk-otel-collector-fips, cluster-api-aws-controller, jitsucom-bulker, bento, vault-fips, sqlexporter, opentelemetry-collector-contrib, argo-events, sqlexporter-fips, amazon-cloudwatch-agent, dapr, dapr-fips, grafana-alloy, vault,...

GHSA-9MJ6-HXHV-W67J vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, splunk-otel-collector-fips, cluster-api-aws-controller, jitsucom-bulker, bento, vault-fips, sqlexporter, opentelemetry-collector-contrib, argo-events, sqlexporter-fips, amazon-cloudwatch-agent, dapr, dapr-fips, grafana-alloy, vault,...