{"id":"CVE-2026-115813","kind":"vulnerability","aliases":["CVE-2026-115813"],"related":[],"title":"AWS Multi Model Server: model download path enables server-side request forgery","description":"CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server\n\n### CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server\n\nBulletin ID: 2026-148-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 10:30 AM PDT\n\nDescription:\n\nAmazon Web Services Multi Model Server (MMS) is an open source tool for serving machine learning models for inference. It was published by AWS on GitHub, PyPI, and Docker Hub, and reached end of life; its source repository has been archived and read-only since November 20, 2025.\n\nWe identified the following issues in MMS:\n\n- CVE-2026-115812: An issue in model archive extraction could allow a crafted model archive to write files outside the intended directory, potentially resulting in code execution with the privileges of the MMS process.\n- CVE-2026-115813: An issue in the model download path could allow the MMS management interface to be directed to make requests to unintended network destinations.\n\nIn both cases, the MMS management interface does not require authentication. Deployments that bind this interface to a network-accessible address are at increased risk.\n\nBecause MMS has reached end of life and is no longer maintained, we recommend that users migrate to a supported model-serving solution.\n\nImpacted versions: <=1.1.11 (all released versions)\n\nResolution:\n\nMulti Model Server is end of life and no fixed version is available or planned on any distribution channel. We recommend that customers discontinue use of Multi Model Server and migrate to a supported model serving solution. Customers who maintain forked or derivative code should apply equivalent changes themselves: reject any archive entry whose resolved path falls outside the extraction directory, and restrict the model-download path to an explicit allowlist of permitted URLs.\n\nWorkarounds:\n\nWhere a deployment binds the inference and management interfaces to separate ports, bind the management interface to the loopback address so it is not reachable from untrusted networks, and do not pass externally supplied URLs to the model-download path. This workaround is not available in every configuration. The configuration shipped for SageMaker-style deployments binds the management interface to all addresses on the same port as inference, so management cannot be moved to loopback there without also disabling model loading. Deployments in that configuration should prioritize migration, and in the interim should ensure the serving port is reachable only by trusted callers.\n\nReferences:\n\n- CVE-2026-115812\n- CVE-2026-115813\n\nAcknowledgement:\n\nWe would like to thank Sujal Tuladhar for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"Amazon Web Services Multi Model Server, an end-of-life tool for serving ML models, lets its unauthenticated management interface be directed to make requests to unintended network destinations. An attacker who can reach that interface can use the server to probe internal services.","severity":"medium","cvss":6.9,"epss":0.0034,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","aws","docker","lab-disclosure","ml-serving","multi-model-server","self-hosted"],"not_affected_if":["external-urls-not-passed","management-interface-loopback-only","not-running-mms"],"how_to_check":"- Check whether `multi-model-server` is installed, for example with `pip show multi-model-server` or by looking for the MMS image in Docker Hub deployments.\n- Check the installed version; the bulletin says all released versions up to `1.1.11` are affected.\n- Check whether the management interface (default port 8081) is bound to a non-loopback address or reachable from untrusted networks.","fix":"- No fixed version exists; AWS says Multi Model Server is end of life and recommends migrating to a supported model-serving solution.\n- Bind the management interface to loopback (`127.0.0.1`) where the configuration allows it.\n- Do not pass externally supplied URLs to the model-download path.\n- In SageMaker-style configurations where management cannot be moved to loopback, restrict the serving port to trusted callers while migrating.","status":"open","published_at":"2026-10-23T00:00:00+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:38:41+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T03:38:41Z","model":"claude-haiku-5-5","output":{"fix":"- No fixed version exists; AWS says Multi Model Server is end of life and recommends migrating to a supported model-serving solution.\n- Bind the management interface to loopback (`127.0.0.1`) where the configuration allows it.\n- Do not pass externally supplied URLs to the model-download path.\n- In SageMaker-style configurations where management cannot be moved to loopback, restrict the serving port to trusted callers while migrating.","reach":"network","title":"AWS Multi Model Server: model download path enables server-side request forgery","impact":"medium","summary":"Amazon Web Services Multi Model Server, an end-of-life tool for serving ML models, lets its unauthenticated management interface be directed to make requests to unintended network destinations. An attacker who can reach that interface can use the server to probe internal services.","category":"ai-tooling","nicknames":[],"who_cares":["multi-model-server","ml-serving","self-hosted","aws","docker"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker makes the server request internal network destinations on their behalf.","analyst_note":"Confirm the affected version range and default management port in the AWS bulletin 2026-148-AWS and the NVD entry; the sources give no exploitation status.","how_to_check":"- Check whether `multi-model-server` is installed, for example with `pip show multi-model-server` or by looking for the MMS image in Docker Hub deployments.\n- Check the installed version; the bulletin says all released versions up to `1.1.11` are affected.\n- Check whether the management interface (default port 8081) is bound to a non-loopback address or reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["not-running-mms","management-interface-loopback-only","external-urls-not-passed"],"who_is_affected":"Teams running Multi Model Server 1.1.11 or earlier, especially where the management interface is bound to a network-accessible address. The SageMaker-style configuration binds management to all addresses on the serving port, so it is exposed there unless the port is limited to trusted callers. Teams not running MMS can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000808,"input_tokens":4280,"output_tokens":760,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115812':85C,100C,191C,490C '-115813':16A,19A,89C,104C,225C,493C '-148':116C '-2026':15A,18A,84C,88C,99C,103C,190C,224C,489C,492C '1.1.11':301C '10':128C '10/23/2026':127C '20':180C '2025':181C '2026':115C '30':129C 'access':269C 'acknowledg':494C 'address':270C,401C,445C 'ai':21B 'ai-tool':20B 'allow':199C,234C 'allowlist':377C 'also':461C 'amazon':38B,92C,107C,133C 'appli':351C 'archiv':173C,196C,203C,357C 'attack':69B 'attent':124C 'authent':259C 'avail':318C,427C 'aw':1A,23B,117C,119C,156C 'aws-security@amazon.com':515C 'bind':262C,385C,394C,439C 'bulletin':113C 'caller':486C 'cannot':454C 'case':251C 'chang':353C 'channel':324C 'code':214C,349C 'collabor':503C 'concern':521C 'configur':430C,432C,468C 'content':120C 'coordin':509C 'could':198C,233C 'craft':201C 'custom':328C,343C 'cve':14A,17A,83C,87C,98C,102C,189C,223C,488C,491C 'date':126C 'deploy':260C,384C,438C,465C 'deriv':348C 'descript':132C 'destin':67B,248C 'direct':60B,241C 'directori':210C,366C 'disabl':462C 'disclosur':27B,511C 'discontinu':329C 'distribut':323C 'docker':24B,161C 'download':6A,231C,372C,421C 'email':514C 'enabl':8A 'end':46B,165C,279C,310C 'end-of-lif':45B 'ensur':477C 'entri':358C 'equival':352C 'everi':429C 'execut':215C 'explicit':376C 'extern':414C 'extract':197C,365C 'fall':362C 'file':206C 'fix':315C 'follow':185C 'forgeri':13A 'fork':346C 'github':158C 'host':37B 'hub':162C 'id':114C 'identifi':183C 'impact':299C 'import':122C 'increas':273C 'infer':151C,387C,451C 'intend':209C 'interfac':58B,74B,238C,255C,264C,390C,397C,442C 'interim':475C 'intern':81B 'issu':90C,105C,186C,193C,227C,506C 'lab':26B 'lab-disclosur':25B 'learn':148C 'let':54B 'life':48B,167C,281C,312C 'like':497C 'load':464C 'longer':285C 'loopback':400C,458C 'machin':147C 'maintain':286C,345C 'make':62B,243C 'manag':57B,237C,254C,389C,396C,441C,453C 'migrat':291C,336C,471C 'ml':29B,52B 'ml-serv':28B 'mms':139C,188C,221C,236C,253C,276C 'model':3A,5A,33B,42B,53B,96C,111C,137C,149C,195C,202C,230C,296C,307C,333C,340C,371C,420C,463C 'model-download':370C,419C 'model-serv':295C 'move':456C 'multi':2A,32B,41B,95C,110C,136C,306C,332C 'multi-model-serv':31B 'network':66B,247C,268C,409C 'network-access':267C 'novemb':179C 'open':142C 'outsid':207C,363C 'pass':413C 'path':7A,232C,361C,373C,422C 'pdt':131C 'permit':379C 'plan':320C 'pleas':513C 'port':393C,449C,480C 'potenti':211C 'priorit':470C 'privileg':218C 'probe':80B 'process':222C,512C 'public':125C 'publish':154C 'pypi':159C 'question':519C 'reach':72B,164C,278C 'reachabl':406C,482C 'read':176C 'read-on':175C 'recommend':288C,326C 'refer':487C 'reject':355C 'releas':303C 'repositori':170C 'request':12A,63B,244C 'requir':123C,258C 'resolut':305C 'resolv':360C 'restrict':368C 'result':212C 'risk':274C 'sagemak':436C 'sagemaker-styl':435C 'scope':118C 'secur':518C 'self':36B 'self-host':35B 'separ':392C 'serv':30B,51B,146C,297C,341C,479C 'server':4A,10A,34B,43B,78B,97C,112C,138C,308C,334C 'server-sid':9A 'servic':40B,82B,94C,109C,135C 'ship':433C 'side':11A 'sinc':178C 'solut':298C,342C 'sourc':143C,169C 'style':437C 'sujal':500C 'suppli':415C 'support':294C,339C 'thank':499C 'tool':22B,49B,144C 'trust':485C 'tuladhar':501C 'type':121C 'unauthent':56B 'unintend':65B,246C 'untrust':408C 'url':380C,416C 'use':76B,330C 'user':290C 'version':300C,304C,316C 'vulner':510C 'web':39B,93C,108C,134C 'whose':359C 'without':460C 'workaround':381C,424C 'would':496C 'write':205C","nicknames":[],"mitigations":[{"kind":"workaround","scope":"Multi Model Server with inference and management on separate ports","since":null,"covers":"Management interface reachable only from loopback, so it is not exposed to untrusted networks","limits":"Not available where management and inference share one port (SageMaker-style configuration); there, moving management to loopback also disables model loading","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-148-aws/","vendor":"Team","seen_at":"2026-10-24T19:43:38Z","confidence":0.8,"source_title":"CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server","customer_action":"Bind the management interface to the loopback address; in shared-port deployments, ensure the serving port is reachable only by trusted callers"},{"kind":"workaround","scope":"Multi Model Server model download path","since":null,"covers":"Model download path when no externally supplied URLs are passed to it","limits":"Does not address the archive extraction issue (CVE-2026-115812); not available in shared-port SageMaker-style configuration except by restricting who can reach the serving port","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-148-aws/","vendor":"Team","seen_at":"2026-10-24T19:43:38Z","confidence":0.75,"source_title":"CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server","customer_action":"Do not pass externally supplied URLs to the model-download path"}],"who_affected":"Teams running Multi Model Server 1.1.11 or earlier, especially where the management interface is bound to a network-accessible address. The SageMaker-style configuration binds management to all addresses on the serving port, so it is exposed there unless the port is limited to trusted callers. Teams not running MMS can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115813","severity":null,"published_at":"2026-10-23T18:17:21+00:00","modified_at":"2026-10-23T19:23:01+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null},{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-148-aws/#CVE-2026-115813","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-148-aws/","severity":null,"published_at":"2026-10-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:43:43+00:00","fetched_at":"2026-10-24T19:43:43+00:00","note":"AWS: CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server"},{"source":"epss","external_id":"CVE-2026-115813","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115813","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[{"id":1263,"url":"https://aws.amazon.com/security/security-bulletins/2026-148-aws/","title":"AWS bulletin 2026-148-AWS: CVE-2026-115812 and CVE-2026-115813 Multi Model Server","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2962,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-148-aws/","title":"AWS: CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server","kind":"advisory","source":"lab","text":"CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server\n\n### CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server\n\nBulletin ID: 2026-148-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 10:30 AM PDT\n\nDescription:\n\nAmazon Web Services Multi Model Server (MMS) is an open source tool for serving machine learning models for inference. It was published by AWS on GitHub, PyPI, and Docker Hub, and reached end of life; its source repository has been archived and read-only since November 20, 2025.\n\nWe identified the following issues in MMS:\n\n- CVE-2026-115812: An issue in model archive extraction could allow a crafted model archive to write files outside the intended directory, potentially resulting in code execution with the privileges of the MMS process.\n- CVE-2026-115813: An issue in the model download path could allow the MMS management interface to be directed to make requests to unintended network destinations.\n\nIn both cases, the MMS management interface does not require authentication. Deployments that bind this interface to a network-accessible address are at increased risk.\n\nBecause MMS has reached end of life and is no longer maintained, we recommend that users migrate to a supported model-serving solution.\n\nImpacted versions: <=1.1.11 (all released versions)\n\nResolution:\n\nMulti Model Server is end of life and no fixed version is available or planned on any distribution channel. We recommend that customers discontinue use of Multi Model Server and migrate to a supported model serving solution. Customers who maintain forked or derivative code should apply equivalent changes themselves: reject any archive entry whose resolved path falls outside the extraction directory, and restrict the model-download path to an explicit allowlist of permitted URLs.\n\nWorkarounds:\n\nWhere a deployment binds the inference and management interfaces to separate ports, bind the management interface to the loopback address so it is not reachable from untrusted networks, and do not pass externally supplied URLs to the model-download path. This workaround is not available in every configuration. The configuration shipped for SageMaker-style deployments binds the management interface to all addresses on the same port as inference, so management cannot be moved to loopback there without also disabling model loading. Deployments in that configuration should prioritize migration, and in the interim should ensure the serving port is reachable only by trusted callers.\n\nReferences:\n\n- CVE-2026-115812\n- CVE-2026-115813\n\nAcknowledgement:\n\nWe would like to thank Sujal Tuladhar for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-23T00:00:00+00:00","relation":"advisory","confidence":null,"note":"AWS disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}