Technical impact
BentoML versions 1.4.19 through 1.4.39 allowed an unfiltered RFC 6598 shared address space to be used for outbound connections. The make_safe_connect function blocks private, loopback, and link‑local IP ranges but mistakenly permits the CGNAT range 100.64.0.0/10. An unauthenticated attacker can supply a URL within this range through multipart file handling or JSON request parsing, leading the server to make outbound requests to internal hosts. This grants the attacker access to internal resources, posing a confidentiality and integrity threat.
Affected Systems
BentoML software, versions 1.4.19‑1.4.39. The vulnerability exists in the outbound connection safeguard located in _internal/utils/uri.py. Users running any of these versions in a production environment are affected.
Risk and Exploitability
The CVSS score of 6.9 indicates a moderate severity vulnerability. EPSS is not available, so the current exploit probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated external request that supplies a URL pointing to the CGNAT range via multipart file uploads or JSON payloads. If the server subsequently makes a request to an internal host, an attacker could read sensitive data or perform actions as the server process.
