AWS won't patch CVSS 9.8 Multi Model Server flaw; management API lacks authentication

AWS discloses two flaws and no fix

On October 23, 2026, AWS published security bulletin 2026-148-AWS covering two vulnerabilities in Multi Model Server (MMS), its open-source tool for serving machine learning models. According to a write-up on dev.to, every released version up to and including 1.1.11 is affected, and the bulletin states that no patched release is planned for any distribution channel.

The more severe issue, CVE-2026-115812, is rated 9.8 on CVSS 3.1 and 9.3 on CVSS 4.0 in Strix's CVE record, which dev.to cites. AWS describes it as a path traversal bug in model archive extraction: a maliciously crafted archive can place files outside the intended directory, potentially achieving code execution under the MMS process's privileges. Strix classifies it as CWE-23.

The second issue, CVE-2026-115813, lets the management interface be pointed at unintended network destinations — in effect, server-side request forgery in the model download path. It scores 5.8 on CVSS 3.1.

An unauthenticated management API

What elevates both bugs is a detail from the bulletin: the MMS management interface ships without authentication. Any deployment that binds it to a network-reachable address is at increased risk, because whoever can reach that port can direct the server to load a model.

The defaults are relatively safe — dev.to notes that inference listens on 127.0.0.1:8080 and management on 127.0.0.1:8081, with localhost-only access out of the box. But the management API exposes a plain GET /models that lists loaded models, and POST /models?url= accepts an HTTP(S) URL to register a new model. Registration is precisely where MMS downloads and unpacks an archive, the two operations these CVEs target.

As of the write-up, no public proof of concept is indexed and the flaw does not appear in CISA's Known Exploited Vulnerabilities catalog, per TheHackerWire and Strix. AWS attributes the reports to coordinated vulnerability disclosure.

End of life, but still widely embedded

There will be no 1.1.12. The MMS GitHub repository was archived on November 20, 2025 and is read-only, yet the package still installs from PyPI under the name multi-model-server and is also published on Docker Hub.

The tool also sits one layer below stacks that never mention it. The SageMaker Inference Toolkit's README states that its serving stack is built on Multi Model Server, and its install instructions pull both packages together. That repository was archived the same day. Teams that built custom inference containers from the toolkit may therefore be running MMS without realising it.

What operators can do

AWS's recommendation is to stop using MMS and move to a supported serving solution. As an interim measure, the bulletin suggests binding management to loopback and avoiding external URLs in the model download path.

There is a catch: in the SageMaker-style configuration, management shares the serving port and listens on all addresses, so moving it to loopback would break model loading entirely. For those deployments, AWS advises prioritising migration and, in the meantime, restricting the serving port to trusted callers — a security group or network policy admitting only the services that actually call the model.

For teams maintaining their own forks, the bulletin offers concrete guidance: reject archive entries whose resolved path falls outside the extraction directory, and restrict model downloads to an explicit URL allowlist. dev.io — sorry, dev.to — provides a short Python example of the standard zip-slip guard implementing the first rule.

Practical detection steps from the write-up include searching repositories for multi-model-server, sagemaker-inference and MMS_CONFIG_FILE, running pip show multi-model-server inside containers, checking inference_address and management_address in config.properties, and probing GET /models from a machine that should not have access. Any response means an attacker would get the same view.

Why it matters

This is what end-of-life looks like in AI infrastructure: a critical, easily reachable code execution path in a serving tool, with no vendor patch ever coming. MMS runs in long-lived inference containers that rarely page anyone, and the unauthenticated management API means a single open port can be enough. Operators who cannot migrate immediately should at minimum verify where management listens and lock it down — because in this case, containment is the only fix that will arrive.