CVE-2026-35044 is a high severity code execution flaw in BentoML, a Python library for AI model serving. NVD scores it 8.8. A malicious bento archive can run Python on the host during containerize. Upgrade to BentoML 1.4.38 or later. The risk is in the build step, so protect the machine that runs it.
What's affected
BentoML before 1.4.38. The fixed release is 1.4.38.
The flaw is reached when someone imports a bento archive that carries a Dockerfile template and then runs bentoml containerize.
How to check if you're exposed
Check the installed version:
pip show bentoml
Check developer machines and build servers, not just serving hosts, since the risk sits in the containerize step. Also list where your team gets bento archives from.
What to do now
- Upgrade with
pip install -U bentomland confirm 1.4.38 or later. - Do not import or containerize bento archives from sources you do not trust.
- Run containerize in a throwaway build environment with no credentials, not on a workstation with cloud keys.
- Pin the version in your lock file.
Why it matters
The weakness is CWE-1336, improper neutralization in a template engine. The advisory says containerize uses a Jinja2 environment that is not sandboxed and has the do extension enabled. Template code from the archive then runs as Python on the host, which bypasses container isolation because the build runs outside the container.
Templates are code. Treating a template file from an archive as plain data is the root error. A sandboxed template environment limits what template authors can do.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Model packaging tools blur the line between data and code. A bento archive looks like a model bundle but can carry templates that are rendered with full Python power on the host. Treat archives from outside your team like any other executable, and do container builds on disposable machines with no standing credentials.
Quick check
Does this affect already built images?
The advisory describes the build step on the host. It does not describe running containers, so the concern is where you build and what you import.
Sources
Last reviewed: 19 October 2026.
