BentoML's outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but… (CVE-2026-78205)
BentoML versions 1.4.19 through 1.4.39 contain a Server-Side Request Forgery (SSRF) vulnerability in the make_safe_connect function. This function blocks private, loopback, and link-local IP addresses but does not block the RFC 6598 shared address space (100.64.0.0/10, CGNAT). An unauthenticated attacker can exploit this by supplying URLs pointing to this CGNAT range via multipart file handling or JSON request parsing, causing the server to make unintended outbound requests. This vulnerability is an incomplete fix of a previous issue (CVE-2025-54381).
AI Analysis
Technical Summary
The vulnerability in BentoML's make_safe_connect function arises because it does not reject the RFC 6598 shared address space (100.64.0.0/10), which is used for Carrier-Grade NAT (CGNAT). Attackers can exploit this by providing URLs targeting this address space through multipart file handling (MultipartSerde.ensure_file) or JSON request parsing (JSONSerde.parse_request). This leads to Server-Side Request Forgery (CWE-918), where the server makes outbound requests to internal hosts on CGNAT networks. The issue affects versions 1.4.19 through 1.4.39 and represents an incomplete fix of CVE-2025-54381.
Potential Impact
An unauthenticated attacker can cause the vulnerable BentoML server to make outbound requests to internal hosts within the CGNAT address space (100.64.0.0/10). This could potentially allow attackers to access internal network resources that are not otherwise reachable, leading to information disclosure. The CVSS score of 5.8 reflects a medium severity with low confidentiality impact, no integrity or availability impact, and no required privileges or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing additional network-level controls to restrict outbound requests to untrusted internal IP ranges, including the RFC 6598 shared address space. Monitoring and filtering of URLs accepted via multipart file handling and JSON request parsing may also help mitigate exploitation.
BentoML's outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but… (CVE-2026-78205)
Description
BentoML versions 1.4.19 through 1.4.39 contain a Server-Side Request Forgery (SSRF) vulnerability in the make_safe_connect function. This function blocks private, loopback, and link-local IP addresses but does not block the RFC 6598 shared address space (100.64.0.0/10, CGNAT). An unauthenticated attacker can exploit this by supplying URLs pointing to this CGNAT range via multipart file handling or JSON request parsing, causing the server to make unintended outbound requests. This vulnerability is an incomplete fix of a previous issue (CVE-2025-54381).
CVSS v3.1
Score 5.8medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in BentoML's make_safe_connect function arises because it does not reject the RFC 6598 shared address space (100.64.0.0/10), which is used for Carrier-Grade NAT (CGNAT). Attackers can exploit this by providing URLs targeting this address space through multipart file handling (MultipartSerde.ensure_file) or JSON request parsing (JSONSerde.parse_request). This leads to Server-Side Request Forgery (CWE-918), where the server makes outbound requests to internal hosts on CGNAT networks. The issue affects versions 1.4.19 through 1.4.39 and represents an incomplete fix of CVE-2025-54381.
Potential Impact
An unauthenticated attacker can cause the vulnerable BentoML server to make outbound requests to internal hosts within the CGNAT address space (100.64.0.0/10). This could potentially allow attackers to access internal network resources that are not otherwise reachable, leading to information disclosure. The CVSS score of 5.8 reflects a medium severity with low confidentiality impact, no integrity or availability impact, and no required privileges or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing additional network-level controls to restrict outbound requests to untrusted internal IP ranges, including the RFC 6598 shared address space. Monitoring and filtering of URLs accepted via multipart file handling and JSON request parsing may also help mitigate exploitation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-x8r7-g3fv-cf37
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-78205"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a8c4c77acd9273b499c0ed7
Added to database: 08/24/2026, 13:51:51 UTC
Last enriched: 08/24/2026, 14:30:51 UTC
Last updated: 08/25/2026, 00:09:40 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.