AWS Won't Patch 9.8-Rated Model Server Flaw

Amazon Web Services said on Oct. 23 that it will not patch two vulnerabilities in Multi Model Server (MMS), its retired open-source tool for serving machine-learning models, including one rated 9.8 out of 10 for severity. The security bulletin tells users to stop running the software and move to a supported alternative.

The notice capped a week in which AWS published five bulletins covering six vulnerabilities in AI and agent tooling between Oct. 20 and Oct. 23. MMS is the only one with no fix.

Key takeaways

• CVE-2026-115812 lets a crafted model archive write files outside the extraction folder, which can lead to code execution. Its CVSS 3.1 score is 9.8.
• AWS says no fixed version of MMS "is available or planned on any distribution channel," because the project reached end of life and its repository was archived on Nov. 20, 2025.
• The same week, AWS shipped fixes for flaws in the Strands Agents SDK, the SageMaker Python SDK, the AWS MCP Server and the Kiro Crew agent.

What the Multi Model Server vulnerabilities do

MMS loads models from archive files through a management interface that, according to AWS, requires no authentication. Deployments that expose it on a network-reachable address face higher risk.

The first flaw, CVE-2026-115812, sits in archive extraction. A crafted archive could place files outside the intended directory and potentially run code with the privileges of the MMS process. The CVE record, published Oct. 23, classifies it as relative path traversal; NVD analysis is pending.

The second, CVE-2026-115813, is in the model download path. AWS says the management interface "could be directed to make requests to unintended network destinations." All released versions up to 1.1.11 are affected. AWS credited researcher Sujal Tuladhar with reporting the issues.

Why the SageMaker-style setup is harder to fix

AWS's main stopgap is to bind the management interface to the local loopback address and never pass external URLs to the download path. That does not work for one common setup. The bulletin says the configuration shipped for SageMaker-style deployments binds management to all addresses on the same port as inference, so the workaround is not available there without disabling model loading.

Those deployments should prioritize migration and limit the serving port to trusted callers, AWS said. The bulletin does not say the managed SageMaker service is affected, and it names no replacement.

Still downloaded about 180,000 times a month

Retired does not mean unused. The multi-model-server package recorded 182,969 downloads from the Python Package Index over the past month, according to PyPI Stats data checked on Oct. 26. The figure includes automated builds and mirrors, so it overstates live servers.

Five AWS AI-tool security bulletins in four days

The SageMaker SDK bug stands out among the patched ones. Its default_bucket() function used a predictably named S3 bucket without checking that the caller's account owned it, so an outsider who created that bucket first could potentially run code in a SageMaker environment and obtain IAM credentials, AWS said. The Strands bulletin describes a multi-tenant flaw in which one authenticated caller could view another's conversation history. The fixes land as AWS widens its open agent tooling, which also includes an agent benchmark that spins up real cloud accounts.

What's next

MMS users must pick a replacement themselves; for forks, AWS advises rejecting archive entries that resolve outside the extraction directory and allowlisting download URLs. Users of the other tools should upgrade to the fixed versions above.

FAQ

Is Amazon SageMaker affected?

AWS does not say the managed service is affected. It warns that self-run MMS deployments using the SageMaker-style configuration cannot use the loopback workaround and should migrate first.

Will AWS release an MMS patch?

No. The bulletin says no fixed version is available or planned, because MMS has reached end of life.

How can I tell if I'm exposed?

Check whether any service installs the multi-model-server package, version 1.1.11 or earlier, and whether its management interface can be reached from the network.

References

• CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server — AWS (Oct. 23, 2026)
• CVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket() — AWS (Oct. 21, 2026)
• CVE-2026-115419 - Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server — AWS (Oct. 22, 2026)
• CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server — AWS (Oct. 23, 2026)
• CVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro Crew — AWS (Oct. 20, 2026)
• multi-model-server recent downloads — PyPI Stats (checked Oct. 26, 2026)
• CVE-2026-115812: multi-model-server Vulnerability (CVSS 9.8) — Strix