Is CVE-2026-112264 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-112264?

CVE-2026-112264 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-112264

Description

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.