Live › vulnerability › CVE-2026-115812
Go to dashboardAmazon Web Services Multi Model Server 1.1.11 and earlier extracts model archives using relative paths, so a crafted archive can write files outside its target directory. An attacker who supplies such an archive can execute arbitrary code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| multi-model-server | pypi | <= 1.1.11 (all releases) | – |
pip show multi-model-server, pip list | grep -i multi-model, a multi-model-server Docker image, or a running multi-model-server processThe fix above is the answer. These hold the line until you can deploy it, and are the only option on lines that get no fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server
Bulletin ID: 2026-148-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 10:30 AM PDT
Description:
Amazon Web Services Multi Model Server (MMS) is an open source tool for serving machine learning models for inference. It was published by AWS on GitHub, PyPI, and Docker Hub, and reached end of life; its source repository has been archived and read-only since November 20, 2025.
We identified the following issues in MMS:
In both cases, the MMS management interface does not require authentication. Deployments that bind this interface to a network-accessible address are at increased risk.
Because MMS has reached end of life and is no longer maintained, we recommend that users migrate to a supported model-serving solution.
Impacted versions: <=1.1.11 (all released versions)
Resolution:
Multi Model Server is end of life and no fixed version is available or planned on any distribution channel. We recommend that customers discontinue use of Multi Model Server and migrate to a supported model serving solution. Customers who maintain forked or derivative code should apply equivalent changes themselves: reject any archive entry whose resolved path falls outside the extraction directory, and restrict the model-download path to an explicit allowlist of permitted URLs.
Workarounds:
Where a deployment binds the inference and management interfaces to separate ports, bind the management interface to the loopback address so it is not reachable from untrusted networks, and do not pass externally supplied URLs to the model-download path. This workaround is not available in every configuration. The configuration shipped for SageMaker-style deployments binds the management interface to all addresses on the same port as inference, so management cannot be moved to loopback there without also disabling model loading. Deployments in that configuration should prioritize migration, and in the interim should ensure the serving port is reachable only by trusted callers.
References:
Acknowledgement:
We would like to thank Sujal Tuladhar for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-115812")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.