AWS will not fix two flaws in its retired Multi Model Server

AWS will not fix two flaws in its retired Multi Model Server

23 October 2026: AWS has disclosed two vulnerabilities in Multi Model Server (MMS), its open-source tool for serving machine learning models, and says no fix is available or planned because the project has reached end of life. CVE-2026-115812 lets a crafted model archive write files outside its directory, which can lead to code execution, and CVE-2026-115813 lets the management interface be steered into making requests to unintended network destinations. Every released version up to 1.1.11 is affected.

Not yet independently verified. AWS gives no CVSS scores, and no public CVE records were available when we checked; the bulletin does not say whether either flaw has been exploited. We will update this when it can be confirmed, and remove this note.

Two flaws behind an open management API

Both issues sit behind the MMS management interface, which loads and unloads models and, AWS notes, "does not require authentication". The first is in model archive extraction: an archive entry whose path points outside the extraction folder is written wherever it points, with the privileges of the MMS process. The second is in the model download path, which accepts a URL and fetches it, giving anyone who can reach the interface a way to make the server request internal addresses.

AWS rates the bulletin "Important (requires attention)". MMS was published on GitHub, PyPI and Docker Hub, and its source repository has been archived and read-only since 20 November 2025.

Why some deployments cannot use the workaround

Where MMS runs inference and management on separate ports, AWS's workaround is to bind the management interface to the loopback address and never pass externally supplied URLs to the download path. That is not available everywhere. The configuration shipped for SageMaker-style deployments puts management on all addresses and on the same port as inference, so it cannot be moved to loopback without also disabling model loading. AWS says those deployments should prioritise migration and, until then, make sure only trusted callers can reach the serving port.

Teams that maintain a fork of MMS are told to make the fixes themselves: reject any archive entry whose resolved path falls outside the extraction directory, and limit model downloads to an explicit allowlist of URLs.

Finding MMS in older stacks

MMS tends to survive inside things built years ago: container images derived from older deep learning images, custom inference containers, and internal model platforms that pinned the PyPI package. Searching image registries and dependency files for the multi-model-server package is the quickest way to find them. Our machine learning software category lists seven products.

On the same day AWS published a second bulletin, 2026-149-AWS, for CVE-2026-115845 in the run_script tool of the AWS MCP Server, where a sandbox weakness could let a script go beyond its intended limits. AWS says it fixed that one on the service side and customers need take no action.

Sources

• AWS Security Bulletin 2026-148-AWS: Multi Model Server, 23 October 2026
• AWS Security Bulletin 2026-149-AWS: AWS MCP Server, 23 October 2026