AWS will not patch a critical flaw in end-of-life Multi Model Server, and loopback fails in SageMaker-style setups

AWS published security bulletin 2026-148-AWS on 23 October for Multi Model Server (MMS), its open-source tool for serving machine learning models. MMS reached end of life, and its repository has been archived and read-only since 20 November 2025. That means the two new bugs will stay unfixed.

The two bugs

• CVE-2026-115812, CVSS 3.1 score 9.8 (critical): a crafted model archive can write files outside the extraction folder during unpacking, which AWS says could lead to code execution with the MMS process’s privileges.
• CVE-2026-115813, CVSS 3.1 score 5.8: the model download path can be pointed at unintended network destinations, a server-side request forgery.

Both are reached through the MMS management interface, which does not require authentication. All released versions, up to 1.1.11 (the latest on PyPI), are affected, and AWS says no fixed version “is available or planned on any distribution channel”.

Why the workaround does not always work

Where inference and management listen on separate ports, AWS suggests binding management to loopback and never passing outside URLs to the download path. But the configuration MMS shipped for SageMaker-style deployments puts management on the same port as inference, bound to all addresses. There, moving management to loopback also disables model loading. AWS says those deployments should prioritise migration and, until then, make sure only trusted callers can reach the serving port.

If you maintain a fork, AWS spells out the fix: reject any archive entry whose resolved path falls outside the extraction directory, and restrict model downloads to an allowlist of URLs. AWS credits Sujal Tuladhar for the coordinated disclosure.

The bulletin does not say whether managed Amazon SageMaker endpoints are affected, and we do not assume they are. The practical risk is older containers and self-built images that still carry MMS. One easy place to miss it: the also-archived SageMaker Inference Toolkit, whose README says its serving stack is built on Multi Model Server, so a custom container built with it may run MMS without naming it.