CVE-2026-78205: BentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address Space
BentoML's outbound connection safeguard (makesafeconnect in internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space (100.64.0.0/10, CGNAT). In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointing to that range via multipart file handling (MultipartSerde.ensurefile) or JSON request parsing (JSONSerde.parserequest), causing the server to make outbound requests to internal hosts on CGNAT networks (Server-Side Request Forgery). This is an incomplete fix for CVE-2025-54381.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
BentoML versions 1.4.19 through 1.4.39 are affected if an attacker can reach request handling that accepts multipart file input or JSON input and can cause the server to fetch a supplied URL. The reachable target must be in the RFC 6598 shared address space, 100.64.0.0/10.
Does exploitation require authentication or user interaction?
No. The issue is described as exploitable by an unauthenticated attacker, with no user interaction required.
What can an attacker do through this flaw?
An attacker can induce the BentoML server to make outbound requests to hosts in the 100.64.0.0/10 CGNAT range. The stated impact is limited to confidentiality impact; no integrity or availability impact is specified.
How can I determine whether my deployment is affected?
Check whether the BentoML version is between 1.4.19 and 1.4.39 inclusive. Also determine whether multipart file handling or JSON request parsing can accept attacker-controlled URLs and whether systems reachable from the server use addresses in 100.64.0.0/10.