CVE-2026-15035: command injection via model repo name

CISO Take

A command injection flaw in BentoML's OpenLLM (0.6.30) lets a local, low-privileged user smuggle shell metacharacters through a model repository directory name into the async_run_command function, resulting in arbitrary command execution on the host. Exploitation requires local access and low privileges but no user interaction, and a working exploit has already been published, which raises the odds of opportunistic abuse on shared ML dev boxes or multi-tenant inference hosts even though this CVE carries no EPSS score and is not in CISA KEV. The scored impact is bounded (CVSS 5.3, confidentiality/integrity/availability all rated low) because exploitation is confined to local context, but the project was notified via issue #1229 and has not yet responded, so no official patch exists — only an open pull request (#1235). Until that PR merges, treat any host running OpenLLM as exposed to local privilege abuse: restrict who can supply or rename model repositories, run the tool under a dedicated low-privilege service account, and monitor for anomalous child-process spawns from the OpenLLM CLI as a detection stopgap.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium overall severity (CVSS 5.3) driven by low complexity and no user interaction, offset by the local-only attack vector and low-privilege access requirement, which caps blast radius to hosts where an attacker already has some local foothold. A public exploit exists, which meaningfully raises real-world exploitability despite the absence of EPSS scoring or CISA KEV listing. The unresolved vendor communication (issue reported, no response, fix only pending in an unmerged PR) means organizations cannot rely on an official patch timeline and must treat this as an open, unpatched local privilege-escalation-adjacent vector for the foreseeable future.

How does the attack unfold?

Local Foothold

Attacker obtains low-privileged local access to a host running OpenLLM, such as a shared ML development or inference server.

Malicious Input Crafting

Attacker creates or renames a model repository directory with a name containing shell metacharacters designed to inject commands.

Command Injection Execution

OpenLLM's async_run_command function passes the unsanitized directory name to the shell, executing the attacker's injected commands.

AML.T0050

Impact

Attacker achieves arbitrary code execution in the context of the OpenLLM process, enabling lateral movement, credential theft, or tampering with locally managed models.

Local Foothold

Attacker obtains low-privileged local access to a host running OpenLLM, such as a shared ML development or inference server.

Malicious Input Crafting

Attacker creates or renames a model repository directory with a name containing shell metacharacters designed to inject commands.

Command Injection Execution

OpenLLM's async_run_command function passes the unsanitized directory name to the shell, executing the attacker's injected commands.

AML.T0050

Impact

Attacker achieves arbitrary code execution in the context of the OpenLLM process, enabling lateral movement, credential theft, or tampering with locally managed models.

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

2.2%

chance of exploitation in 30 days

Higher than 82% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Track upstream PR #1235 (github.com/bentoml/OpenLLM/pull/1235) for the official fix and apply it as soon as it merges, since no released patched version exists yet. In the interim: restrict who can create or rename model repositories consumed by OpenLLM, run OpenLLM under a dedicated low-privilege, non-shared service account rather than a shared multi-user account, avoid processing model repo names from untrusted or externally-supplied sources, and add process-execution monitoring (EDR/auditd) for unexpected child processes spawned by the openllm binary as a compensating detection control.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Inference Framework AML.T0011 - User Execution AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2 - AI system development and technical documentation controls

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-15035?

A command injection flaw in BentoML's OpenLLM (0.6.30) lets a local, low-privileged user smuggle shell metacharacters through a model repository directory name into the async_run_command function, resulting in arbitrary command execution on the host. Exploitation requires local access and low privileges but no user interaction, and a working exploit has already been published, which raises the odds of opportunistic abuse on shared ML dev boxes or multi-tenant inference hosts even though this CVE carries no EPSS score and is not in CISA KEV. The scored impact is bounded (CVSS 5.3, confidentiality/integrity/availability all rated low) because exploitation is confined to local context, but the project was notified via issue #1229 and has not yet responded, so no official patch exists — only an open pull request (#1235). Until that PR merges, treat any host running OpenLLM as exposed to local privilege abuse: restrict who can supply or rename model repositories, run the tool under a dedicated low-privilege service account, and monitor for anomalous child-process spawns from the OpenLLM CLI as a detection stopgap.

Is CVE-2026-15035 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-15035, increasing the risk of exploitation.

How to fix CVE-2026-15035?

Track upstream PR #1235 (github.com/bentoml/OpenLLM/pull/1235) for the official fix and apply it as soon as it merges, since no released patched version exists yet. In the interim: restrict who can create or rename model repositories consumed by OpenLLM, run OpenLLM under a dedicated low-privilege, non-shared service account rather than a shared multi-user account, avoid processing model repo names from untrusted or externally-supplied sources, and add process-execution monitoring (EDR/auditd) for unexpected child processes spawned by the openllm binary as a compensating detection control.

What systems are affected by CVE-2026-15035?

This vulnerability affects the following AI/ML architecture patterns: model serving, local LLM inference tooling, ml_ops CLI pipelines.

What is the CVSS score for CVE-2026-15035?

CVE-2026-15035 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 2.22%.

What is the AI security impact?

Affected AI Architectures

model servinglocal LLM inference toolingml_ops CLI pipelines

MITRE ATLAS Techniques

AML.T0011 User Execution

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing a manipulation of the argument cmd results in command injection. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker with low-privileged local access to a host running OpenLLM (e.g., a shared ML training/inference server or a compromised low-priv account) creates or renames a model repository directory using a name containing shell metacharacters designed to break out of the intended command context. When OpenLLM's async_run_command function in src/openllm/common.py processes this directory name as part of the cmd argument, the unsanitized input is passed to the underlying shell, executing the attacker's injected commands with the privileges of the OpenLLM process — enabling further lateral movement, credential harvesting, or tampering with locally hosted models.

Weaknesses (CWE)

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'): The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

[Requirements] Programming languages and supporting technologies might be chosen which are not subject to these issues.
[Implementation] Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

Source: MITRE CWE corpus.