Tenable Research recently discovered that the original patch for a critical vulnerability affecting BentoML could be bypassed. In this blog, we explain in detail how we discovered this patch bypass in this widely used open source tool. The vulnerability is now fully patched.

How Tenable Found a Way To Bypass a Patch for BentoML’s Server-Side Request Forgery Vulnerability CVE-2025-54381

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force the server to make arbitrary HTTP requests. The vulnerability stems from the multipart form data and JSON request handlers, which automatically download files from user-provided URLs without validating whether those URLs point to internal network addresses, cloud metadata endpoints, or other restricted resources. The documentation explicitly promotes this URL-based file upload feature, making it an intended design that exposes all deployed services to SSRF attacks by default. Version 1.4.19 contains a patch for the issue.

According to its banner, the version of BentoML running on the remote host is 1.4.x < 1.4.8. It is, therefore, affected by a Server-Side Request Forgery (SSRF) vulnerability in File Upload Processing.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - BentoML is a Python library for building online serving systems optimized for AI apps and model inference.
    In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that
    allows unauthenticated remote attackers to force the server to make arbitrary HTTP requests. The
    vulnerability stems from the multipart form data and JSON request handlers, which automatically download
    files from user-provided URLs without validating whether those URLs point to internal network addresses,
    cloud metadata endpoints, or other restricted resources. The documentation explicitly promotes this URL-
    based file upload feature, making it an intended design that exposes all deployed services to SSRF attacks
    by default. Version 1.4.19 contains a patch for the issue. (CVE-2025-54381)

ID	Name	Product	Family	Severity
114932	BentoML 1.4.x < 1.4.19 Server-Side Request Forgery	Web App Scanning	Artificial Intelligence	critical
428673	SCA: security update for bentoml (GHSA-mrmq-3q62-6cc8)	Tenable Cloud Security	SCA Checks	critical
428673	SCA: security update for bentoml (GHSA-mrmq-3q62-6cc8)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2025-54381

critical

Tenable Plugins

critical

critical

critical