#model-serving

AI Safety

BentoML SSRF Fix Missed the Carrier-Grade NAT Range

An incomplete fix for a 2025 SSRF, reachable because the standard library does not classify CGNAT space as internal.

6d ago

A VulnCheck advisory card for BentoML 1.4.19 through 1.4.39, server-side request forgery via unfiltered RFC 6598 shared address space, listing CVE-2026-78205 at severity medium, CVSS 6.9.

AI Safety

Ray Fixed a Serve Port That Skipped Token Auth, No CVE

The internal gRPC server in every Ray Serve replica was bound with add_insecure_port and reached pickle.loads before checking credentials. It shipped as a routine bug fix.

Aug 23, 2026

GitHub release card for Ray-2.58.0, showing a Highlights section whose first entry concerns Ray Serve LLM, with 86 contributors credited.