CVE-2025-32375

BentoML, a Python framework for serving AI models and inference workloads, is affected by an insecure deserialization flaw (CWE-502) in its runner server in all versions prior to 1.4.8. An unauthenticated attacker can trigger the flaw by sending a crafted POST request with specific headers and parameters to a reachable runner service, causing arbitrary code execution on the server. Successful exploitation provides initial access to the host and potential disclosure of sensitive information, such as model data or environment secrets. Anyone running BentoML before 1.4.8 with the runner server reachable by untrusted clients is affected. A public proof of concept is available via the vendor's GitHub advisory, and the high EPSS score (52.1%, 99th percentile) indicates a substantial probability of active exploitation within 30 days, though the flaw is not yet in CISA KEV.

What to do: Upgrade BentoML to version 1.4.8 or later. Until patched, restrict network access to the runner service (do not expose its RPC port to untrusted networks or the internet), and review access logs for unexpected POST requests with unusual headers/parameters. If compromise is suspected, rotate secrets and credentials available in the serving environment.