BentoML RCE via insecure deserialization (v1.4.2)
Date: 2025
Affected: BentoML 1.4.2
Attack vector: deserialization
Category: vulnerability-disclosure
Severity: Critical

RCE caused by insecure deserialization in BentoML v1.4.2 allows unauthenticated attackers to execute arbitrary code on the server.


Mitigations:

Architectural layers (MAESTRO):