CVE-2025-54381
Published: 29 July 2025
Summary
CVE-2025-54381 is a critical-severity SSRF (CWE-918) vulnerability in Bentoml Bentoml. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Service Discovery (T1046); ranked in the top 28.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as APIs and Models; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the SSRF vulnerability by identifying, reporting, and applying the specific patch released in BentoML version 1.4.19.
Requires validation of user-provided URLs in multipart form data and JSON handlers to block malicious internal or restricted resource requests.
Enforces boundary protections to monitor and restrict the BentoML server's outbound HTTP requests to internal networks, cloud metadata, or restricted resources.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF vulnerability enables exploitation of public-facing application (T1190), internal network service discovery via arbitrary HTTP requests (T1046), cloud service discovery (T1526), and access to cloud metadata endpoints for unsecured credentials (T1552.005).
NVD Description
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force the server…
more
to make arbitrary HTTP requests. The vulnerability stems from the multipart form data and JSON request handlers, which automatically download files from user-provided URLs without validating whether those URLs point to internal network addresses, cloud metadata endpoints, or other restricted resources. The documentation explicitly promotes this URL-based file upload feature, making it an intended design that exposes all deployed services to SSRF attacks by default. Version 1.4.19 contains a patch for the issue.
Deeper analysisAI
CVE-2025-54381 is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in the BentoML Python library, which is used for building online serving systems optimized for AI applications and model inference. The issue affects versions 1.4.0 through 1.4.19 and resides in the file upload processing system, specifically the multipart form data and JSON request handlers. These handlers automatically download files from user-provided URLs without validation, allowing requests to internal network addresses, cloud metadata endpoints, or other restricted resources. The feature is promoted in the documentation as an intended URL-based file upload mechanism, leaving deployed BentoML services exposed by default. The vulnerability carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L).
Unauthenticated remote attackers can exploit this vulnerability by sending crafted requests with malicious URLs, forcing the BentoML server to initiate arbitrary HTTP requests on their behalf. This enables attackers to scan and interact with internal networks, access sensitive metadata services (such as those in cloud environments), or probe restricted resources that are inaccessible from the public internet.
The BentoML project has addressed the issue in version 1.4.19 via a patch detailed in GitHub commit 534c3584621da4ab954bdc3d814cc66b95ae5fb8. Security practitioners should upgrade to this version immediately, as advised in the GitHub Security Advisory GHSA-mrmq-3q62-6cc8.
Given BentoML's focus on AI model serving, this SSRF vulnerability is particularly relevant for ML/AI deployments, where exposed inference endpoints could be leveraged to pivot into internal infrastructure hosting training data or proprietary models. No public reports of real-world exploitation were noted at publication on 2025-07-29.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- APIs and Models
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- BentoML is a Python library and platform specifically designed for building online serving systems optimized for AI applications and model inference, fitting the 'Other Platforms' category for AI/ML serving infrastructure.