CVE-2025-32375: BentoML runner server insecure deserialization enables unauthenticated RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, and public exploit code plus high EPSS make this an urgent remote code execution risk.

What it is

BentoML before 1.4.8 deserializes untrusted data in its runner server. By sending a crafted POST request with specific headers and parameters, an attacker can execute arbitrary code on the server. The flaw is fixed in 1.4.8.

Impact

An unauthenticated attacker gains remote code execution on the BentoML runner server, leading to initial access and information disclosure.

Attack surface

Reachable over the network via a POST request to the runner server; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is 0.52415 (98.9th percentile) and the vendor advisory is tagged Exploit, indicating public exploit code exists.

What to do

• Upgrade BentoML to 1.4.8 or later immediately.
• Restrict network access to BentoML runner servers to trusted clients only.
• Place runner servers behind authentication and a reverse proxy where feasible.
• Monitor for and block POST requests containing unexpected serialized payloads or headers.

Detection

• Inspect BentoML runner server logs for anomalous POST requests with unusual headers or parameters.
• Monitor for unexpected child processes or outbound connections spawned by the BentoML process.
• Use network detection to flag serialized payload patterns in HTTP request bodies to runner endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.