CVE-2026-15035 — MEDIUM (5.3)

Vulnerability Description

A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing a manipulation of the argument cmd results in command injection. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Bentoml	Openllm	0.6.30

Related Weaknesses (CWE)

CWE-74 CWE-78 CWE-77

References

https://github.com/bentoml/OpenLLM/Product
https://github.com/bentoml/OpenLLM/issues/1229ExploitPatchThird Party Advisory
https://github.com/bentoml/OpenLLM/pull/1235ExploitPatch
https://vuldb.com/cve/CVE-2026-15035Third Party AdvisoryVDB Entry
https://vuldb.com/submit/850895ExploitThird Party AdvisoryVDB Entry
https://vuldb.com/vuln/376786Third Party AdvisoryVDB Entry
https://vuldb.com/vuln/376786/ctiPermissions Required

FAQ

What is CVE-2026-15035?

CVE-2026-15035 is a vulnerability with a CVSS score of 5.3 (MEDIUM). A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing ...

How severe is CVE-2026-15035?

CVE-2026-15035 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-15035?

Check the references section above for vendor advisories and patch information. Affected products include: Bentoml Openllm.