AWS Warns of Two Vulnerabilities in End-of-Life Multi Model Server

AWS has disclosed two security vulnerabilities in Amazon Web Services Multi Model Server (MMS), an open-source tool used to serve machine learning models for inference. The issues affect all released versions of the software, up to and including version 1.1.11.

The vulnerabilities could allow a crafted model archive to write files outside its intended extraction directory or cause the server's management interface to send requests to unintended network destinations.

A key concern is that the MMS management interface does not require authentication. According to AWS, deployments that bind this interface to a network-accessible address face increased risk.

MMS has reached end of life and is no longer maintained. Its source repository has been archived and made read-only since November 20, 2025. AWS has confirmed that no fixed version is available or planned and recommends that customers discontinue using MMS and migrate to a supported model-serving solution.

Two Vulnerabilities Affect Model Serving and Network Requests

AWS identified the issues under two CVE identifiers: CVE-2026-115812 and CVE-2026-115813. Although both affect MMS, they involve different attack paths.

CVE-2026-115812: Unsafe Model Archive Extraction

The first vulnerability concerns how MMS extracts model archives.

A crafted model archive could cause files to be written outside the directory intended for extraction. Depending on the circumstances, this could potentially lead to code execution with the privileges of the MMS process.

This issue makes archive path validation an important security consideration for applications that handle model packages. Software should ensure that archive entries resolve to locations within the intended extraction directory rather than allowing files to be written elsewhere.

AWS recommends that organizations maintaining their own MMS forks or derivative code reject any archive entry whose resolved path falls outside the extraction directory.

CVE-2026-115813: Requests to Unintended Network Destinations

The second vulnerability affects the model download path.

According to AWS, the issue could allow the MMS management interface to be directed to make requests to unintended network destinations.

The management interface does not require authentication. As a result, deployments that expose it to network access face increased risk.

AWS recommends that maintainers of forked or derivative code restrict the model-download path to an explicit allowlist of permitted URLs. This provides a defined set of destinations that the download mechanism is allowed to access.

The two vulnerabilities therefore involve different controls: one concerns where extracted files can be written, while the other concerns where the server can be directed to make network requests.

Why the End-of-Life Status Matters

MMS was published by AWS as an open-source model-serving tool through GitHub, PyPI, and Docker Hub. It has since reached end of life, and its source repository has been archived and made read-only since November 20, 2025.

This status affects how organizations should respond to the vulnerabilities.

AWS states that all released versions are impacted, with the bulletin listing the affected version range as 1.1.11 and earlier. Because the software is no longer maintained, there is no fixed version available or planned on any distribution channel.

Organizations cannot rely on an upcoming official MMS release to address these issues. AWS instead recommends discontinuing the use of MMS and migrating to a supported model-serving solution.

For teams that maintain their own forks or derivative implementations, AWS recommends applying equivalent security changes themselves. These include validating archive extraction paths and restricting model downloads to an explicit allowlist of permitted URLs.

AWS's Recommended Mitigations and Workarounds

AWS recommends migrating away from MMS because the software is no longer maintained. It also outlines interim measures for deployments where immediate migration is not possible.

1. Restrict access to the management interface

Where the inference and management interfaces use separate ports, AWS recommends binding the management interface to the loopback address so it cannot be reached from untrusted networks.

This workaround is not possible in every configuration.

In the configuration shipped for SageMaker-style deployments, the management interface is bound to all addresses on the same port as inference. In this setup, moving the management interface to loopback would also disable model loading.

AWS advises deployments using this configuration to prioritize migration. Until migration is completed, the serving port should be reachable only by trusted callers.

2. Avoid externally supplied URLs in the model-download path

AWS advises users not to pass externally supplied URLs to the model-download path.

For teams maintaining forks or derivative code, AWS recommends enforcing an explicit allowlist of permitted URLs. This restricts the download mechanism to destinations specifically approved by the implementation's maintainers.

3. Validate model archive extraction paths

Maintainers of derivative code should reject any archive entry whose resolved path falls outside the intended extraction directory.

This change addresses the unsafe archive extraction behavior associated with CVE-2026-115812.

These measures are not a replacement for migration to supported software. Their applicability also depends on the deployment configuration, and AWS notes that the loopback workaround is not available in every setup.

What Organizations Using MMS Should Consider

The bulletin highlights a practical challenge for teams operating legacy machine learning infrastructure: a security issue in end-of-life software may require a migration decision rather than a routine version update.

Organizations using MMS should establish whether their deployments expose the unauthenticated management interface to untrusted networks, identify which configuration they run, and determine whether the documented interim controls apply.

Teams maintaining internal forks should review the relevant archive extraction and model-download code paths and apply the changes recommended by AWS. They should also account for the limitations of the loopback workaround in configurations where management and inference share a port.

Most importantly, organizations should treat migration as the primary response. AWS has not announced a patched release for MMS.

Conclusion

AWS has disclosed two vulnerabilities in its end-of-life Multi Model Server: one involving model archive extraction and another involving requests to unintended network destinations. Both affect all released versions, and the unauthenticated management interface increases concern for deployments exposed to network access.

Because MMS is no longer maintained and no fixed version is available or planned, AWS recommends discontinuing its use and migrating to a supported model-serving solution. Interim controls can reduce exposure in applicable configurations, but they do not change the software's end-of-life status.