An attacker can supply a specially crafted 'bentofile.yaml' or an imported bento archive that includes newline characters within these keys. When the 'bentoml containerize' command is executed, the template engine renders a malicious Dockerfile that incorporates unintended build instructions. This flaw allows an attacker to execute arbitrary commands during the 'docker build' phase. This is a significant risk for CI/CD pipelines, as successful exploitation can lead to the exfiltration of build-time secrets, unauthorized modification of container images (image poisoning), and potential compromise of the build environment or the resulting containerized service.

Attack Chain

1. Attacker crafts a malicious 'bentofile.yaml' containing a 'docker.env' mapping key that includes newline characters and injected Docker instructions (e.g., a RUN command).
2. Attacker provides the malicious file to a developer or uploads it to a source repository, or distributes a crafted bento archive.
3. A user or automated CI/CD pipeline triggers the 'bentoml containerize' command using the malicious configuration.
4. The BentoML template engine processes the 'base.j2' file and fails to sanitize the injected newline characters in the environment mapping keys.
5. The rendering process writes the injected instructions into the generated Dockerfile as valid Docker build commands.
6. The system executes 'docker build' using the compromised Dockerfile.
7. The Docker engine executes the injected RUN instruction with the privileges of the build process.
8. Final objective achieved: Exfiltration of build environment secrets, image poisoning, or code execution within the CI/CD pipeline.

Impact

Successful exploitation allows for the execution of arbitrary commands during container image creation. In enterprise environments, this impacts the integrity of the software supply chain. Attackers may gain access to build-time environment variables, credentials, or API keys defined in the CI/CD pipeline. Additionally, attackers can poison the final container image, leading to downstream execution of malicious code in production environments that deploy the compromised BentoML container.

Recommendation

• Upgrade BentoML to a version beyond 1.4.39 to ensure the fix for CVE-2026-112264 is applied.
• Audit CI/CD pipeline configurations that use 'bentoml containerize' for any untrusted input in 'bentofile.yaml' files.
• Implement strict code review processes for any changes to 'bentofile.yaml' or related bento archive imports.
• Restrict access to build secrets; use short-lived credentials for CI/CD tasks to limit the impact of potential secret exfiltration via build-time injection.