Bulletin ID: 2026-148-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/23/2026 10:30 AM PDT
Description:
Amazon Web Services Multi Model Server (MMS) is an open source tool for serving machine learning models for inference. It was published by AWS on GitHub, PyPI, and Docker Hub, and reached end of life; its source repository has been archived and read-only since November 20, 2025.
CVE-2026-115812: An issue in model archive extraction could allow a crafted model archive to write files outside the intended directory, potentially resulting in code execution with the privileges of the MMS process.
CVE-2026-115813: An issue in the model download path could allow the MMS management interface to be directed to make requests to unintended network destinations.
Impacted versions: <=1.1.11 (all released versions)
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Read the original article:
CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server