AWS Multi Model Server CVE-2026-115812: no patch, migrate off

AWS published a security bulletin on October 23 for Multi Model Server (MMS), its open source tool for serving ML models. CVE-2026-115812 lets a crafted model archive write files outside the target directory, which can lead to code execution. The management interface needs no authentication. And there will be no patch: MMS is end of life, so every released version stays vulnerable. If an old inference box in your stack runs MMS, the only fix is to move off it.

What actually happened

AWS bulletin 2026-148-AWS covers two issues in all MMS releases up to and including 1.1.11:

• CVE-2026-115812: model archive extraction does not keep files inside the target directory. A crafted archive can write files anywhere the MMS process can, and AWS says that can lead to code execution with the privileges of that process. TheHackerWire lists a CVSS score of 9.8.
• CVE-2026-115813: the model download path can make the management interface send requests to network destinations it should not reach.

Both issues go through the management interface, and it has no authentication. AWS says deployments that bind it to a network address face more risk. The MMS repository has been archived and read-only since November 20, 2025. AWS says no fixed version is available or planned, and tells customers to "discontinue use of Multi Model Server" and migrate to a supported serving solution. It does not name one.

The short-term workaround is limited. If inference and management run on separate ports, bind management to loopback and never pass outside URLs to the download path. The SageMaker-style setup puts both on one port on all addresses, so AWS says those deployments must migrate first and, until then, allow only trusted callers to reach the port.

Why the Multi Model Server CVE matters for your business

Abandoned infra is still infra. MMS was a common way to put a model behind an HTTP endpoint a few years ago. A lot of those endpoints are still running: a fraud score, a product tagger, a demand forecast someone deployed and nobody touched again. End of life does not turn the server off. It only means nobody fixes it.

"No patch" changes the work. You cannot add this to the usual patch cycle. You need an owner, a replacement serving stack, and a cutover date. Start with the inventory: search your containers and requirements files for multi-model-server and mxnet-model-server.

A model file is input. This bug is in archive extraction. Any pipeline that loads model files from a bucket, a vendor, or a teammate's upload should treat those files as untrusted code until they are checked.

Sources: AWS Security Bulletin 2026-148-AWS, TheHackerWire CVE-2026-115812 entry.