CVE-2026-15035: bentoml OpenLLM 0.6.30 Command Injection Vulnerability

Technical summary

The vulnerability resides in the Model Repository Directory Name Handler component within `src/openllm/common.py`. The `async_run_command` function fails to properly sanitize or validate the `cmd` parameter before passing it to system execution. This classic command injection pattern (CWE-74, CWE-77, CWE-78) allows an authenticated local user to break out of intended command boundaries and execute arbitrary shell commands with the privileges of the OpenLLM process. The attack requires no user interaction and operates with the same privilege level as the application instance.

Business impact

Organizations using OpenLLM 0.6.30 in shared compute environments—particularly ML platforms, data science workbenches, or containerized deployments—face elevated insider risk. A compromised or malicious user account could escalate privileges, access sensitive model weights or training data, pivot to adjacent systems, or disrupt service availability. Development teams relying on this component should treat this as a containment issue until patched. The lack of vendor response as of the disclosure date suggests remediation timelines remain unclear.

Affected systems

bentoml OpenLLM version 0.6.30 is confirmed affected. Operators should verify whether they are running this specific version or adjacent versions that may incorporate the same vulnerable code pattern. Check deployment manifests, container images, and dependency pinning. Users on newer versions or forks should consult the project's issue tracker or advisory channels for confirmation of remediation status.

Exploitability

Exploitability is limited by the requirement for local system access and valid user credentials. An attacker cannot exploit this remotely without first obtaining local shell access or a valid account. However, the straightforward nature of command injection and public availability of exploit information means that any insider threat actor or compromised account presents immediate risk. Development and staging environments, which often have looser access controls, are particularly vulnerable.

Remediation

Upgrade bentoml OpenLLM to a patched version once available. Until then, implement the following mitigations: (1) Restrict local system access and shell account provisioning to trusted personnel only; (2) Run OpenLLM processes with minimal required privileges and within restrictive container security contexts; (3) Monitor and log all command execution within OpenLLM processes; (4) Isolate affected systems from critical infrastructure; (5) Review and revoke unnecessary user accounts. Contact the bentoml project directly via their issue tracker or security contact for patch timelines.

Patch guidance

Verify the latest version of bentoml OpenLLM against the official project repository and release notes. As of the vulnerability publication date, the project had not released a fix; confirm patch availability before upgrading. When a patched version is released, test thoroughly in non-production environments first, as command handling changes may affect dependent workflows. Document your testing results and update change logs accordingly.

Detection guidance

Monitor system logs and OpenLLM application logs for suspicious command execution patterns, especially those involving shell metacharacters (backticks, pipes, semicolons, $() syntax) passed as arguments to internal functions. Implement file integrity monitoring on `src/openllm/common.py` to detect unauthorized modifications. In containerized environments, use runtime security tools to detect process execution that deviates from baseline behavior. Audit local user account activity, particularly privilege escalation attempts and credential usage patterns on systems running OpenLLM.

Why prioritize this

Although the CVSS score of 5.3 is medium, the combination of public exploit availability, ease of exploitation for local attackers, and unclear patch timeline warrants prompt action. Prioritize systems in shared environments, development clusters, and any deployment where user isolation is weak. However, this does not require emergency patching in isolated, single-user, or air-gapped deployments where local access is already tightly controlled.

Risk score, explained

The CVSS:3.1 score of 5.3 (MEDIUM) reflects local attack vector, low attack complexity, low privilege requirement, and moderate impact (confidentiality, integrity, and availability). The score does not account for the public exploit availability or the vendor's lack of response at disclosure; security teams should factor these into their own risk assessments. Organizations with strict local access controls may rate this lower; those with shared environments should rate it higher.

Frequently asked questions