--- id: "CVE-2026-115812" kind: "vulnerability" aliases: ["CVE-2026-115812"] title: "Multi Model Server: crafted model archive escapes folder and runs code" severity: "critical" cvss: 9.8 epss: 0.00733 exploited: false status: "open" category: "ai-tooling" products: [{"name": "multi-model-server", "fixed": [], "affected": "<= 1.1.11 (all releases)", "ecosystem": "pypi"}] ecosystems: ["pypi"] tags: ["ai-tooling", "aws", "end-of-life", "lab-disclosure", "ml-inference", "model-serving", "multi-model-server", "python", "sagemaker", "self-hosted"] not_affected_if: ["managed-hosting", "management-interface-loopback-only", "no-model-archives-from-untrusted-sources"] published_at: "2026-10-23T00:00:00+00:00" first_seen_at: "2026-10-23T21:57:34+00:00" updated_at: "2026-10-25T12:38:50+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115812", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:00:42+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:31:36+00:00"}, {"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-148-aws/", "first_seen_at": "2026-10-24T19:43:43+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115812", "first_seen_at": "2026-10-25T12:38:50+00:00"}] --- # Multi Model Server: crafted model archive escapes folder and runs code Amazon Web Services Multi Model Server 1.1.11 and earlier extracts model archives using relative paths, so a crafted archive can write files outside its target directory. An attacker who supplies such an archive can execute arbitrary code on the server. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - pypi:multi-model-server affected <= 1.1.11 (all releases) fixed ? ## How to check Find MMS: 'pip show multi-model-server', 'pip list | grep -i multi-model', a multi-model-server Docker image, or a running multi-model-server process. Every version is affected. Then check where the management interface listens (management_address in config.properties) and whether untrusted parties can reach it or supply archives or model URLs. SageMaker-style configs serve management on the same port as inference, on all addresses. Exact endpoint and delivery path are not named in the AWS bulletin. ## Fix No fixed version exists; the project is end of life. Stop using Multi Model Server and migrate to a supported model serving solution. ## Mitigated for you by - Team (workaround): covers Management interface reachable only from loopback, so it is not exposed to untrusted networks Limits: Not available where management and inference share one port (SageMaker-style configuration); there, moving management to loopback also disables model loading Still: Bind the management interface to the loopback address; in shared-port deployments, ensure the serving port is reachable only by trusted callers https://aws.amazon.com/security/security-bulletins/rss/2026-148-aws/ ## Timeline - 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115812 - 2026-10-23T22:00:42+00:00 analyst — Read AWS bulletin 2026-148-AWS (primary). All versions <=1.1.11 affected, no fix ever. No PoC or exploitation found; X search skipped (generic term, noisy). Sibling CVE-2026-115813 (SSRF in model download) is in the same bulletin. - 2026-10-23T22:31:36+00:00 analyst — Triage pass cleared how_to_check and replaced not_affected_if; restored from AWS bulletin 2026-148-AWS. No new sources. Delivery: bulletin says management interface is unauthenticated and loads models, but does not name the endpoint; local-file vs upload not stated. Dropped managed-hosting tag (bulletin does not support it). - 2026-10-24T19:43:43+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-148-aws/ — AWS: CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server - 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115812 ## Documents - [advisory] AWS bulletin 2026-148-AWS: CVE-2026-115812 and CVE-2026-115813 Multi Model Server https://aws.amazon.com/security/security-bulletins/2026-148-aws/ - [advisory] AWS: CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server https://aws.amazon.com/security/security-bulletins/rss/2026-148-aws/ - [describes] awslabs/multi-model-server releases (archived Nov 20 2025, last v1.1.11) https://github.com/awslabs/multi-model-server/releases ## From the sources CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server ### CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server Bulletin ID: 2026-148-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 10:30 AM PDT Description: Amazon Web Services Multi Model Server (MMS) is an open source tool for serving machine learning models for inference. It was published by AWS on GitHub, PyPI, and Docker Hub, and reached end of life; its source repository has been archived and read-only since November 20, 2025. We identified the following issues in MMS: - CVE-2026-115812: An issue in model archive extraction could allow a crafted model archive to write files outside the intended directory, potentially resulting in code execution with the privileges of the MMS process. - CVE-2026-115813: An issue in the model download path could allow the MMS management interface to be directed to make requests to unintended network destinations. In both cases, the MMS management interface does not require authentication. Deployments that bind this interface to a network-accessible address are at increased risk. Because MMS has reached end of life and is no longer maintained, we recommend that users migrate to a supported model-serving solution. Impacted versions: <=1.1.11 (all released versions) Resolution: Multi Model Server is end of life and no fixed version is available or planned on any distribution channel. We recommend that customers discontinue use of Multi Model Server and migrate to a supported model serving solution. Customers who maintain forked or derivative code should apply equivalent changes themselves: reject any archive entry whose resolved path falls outside the extraction directory, and restrict the model-download path to an explicit allowlist of permitted URLs. Workarounds: Where a deployment binds the inference and management interfaces to separate ports, bind the management interface to the loopback address so it is not reachable from untrusted networks, and do not pass externally supplied URLs to the model-download path. This workaround is not available in every configuration. The configuration shipped for SageMaker-style deployments binds the management interface to all addresses on the same port as inference, so management cannot be moved to loopback there without also disabling model loading. Deployments in that configuration should prioritize migration, and in the interim should ensure the serving port is reachable only by trusted callers. References: - CVE-2026-115812 - CVE-2026-115813 Acknowledgement: We would like to thank Sujal Tuladhar for collaborating on this issue through the coordinated vulnerability disclosure process. Please email aws-security@amazon.com with any security questions or concerns. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_