End of Life Means No Patch: Unauthenticated RCE (CVE-2026-115812, 9.8) and SSRF (CVE-2026-115813) in AWS Multi Model Server

2026-10-26 AI Vulnerabilities & CVEs by al-ice.ai Editorial

On 23 October 2026 AWS published security bulletin 2026-148-AWS disclosing two vulnerabilities in Multi Model Server (MMS), its open-source tool for serving machine-learning models for inference — and in the same breath announced there will never be a fix. MMS reached end of life, its source repository has been archived and read-only since 20 November 2025, and AWS’s recommendation is a single line: discontinue use and migrate to a supported model-serving solution. Every released version through 1.1.11 — that is, all of them — is affected. One of the two flaws lets a remote, unauthenticated actor turn a crafted model archive into code execution with the privileges of the MMS process. The other turns the model download path into a server-side request forgery channel. And the management interface behind both requires no authentication, so any deployment that bound it to a network-accessible address is exposed by configuration as well as by code.

The pair, in severity order

CVE-2026-115812 (CVSS 3.1 9.8 Critical; CVSS 4.0 9.3): relative path traversal during model-archive extraction. MMS mishandles relative path specifiers when extracting a model archive, so a crafted archive writes files outside the intended directory — potentially resulting in code execution as the MMS process (CWE-23). The NVD vector tells the whole story at a glance: AV:N/AC:L/PR:N/UI:N, full confidentiality, integrity, and availability impact. No credentials, no user interaction, network-reachable. This is the model-artifact-as-code-execution pattern this site has documented all year: LMCache unpickling whatever reaches its multiprocess port, SGLang’s decoder-envelope confusion, and LightLLM shipping allow_pickle on 0.0.0.0 with ten CVEs and no patch. A model archive is an attacker-controlled tarball by design — every serving stack that extracts one without constraining where the bytes land is one crafted upload away from this exact bulletin. (A scoring note for readers cross-referencing aggregators: some list this as 9.8 and others as 9.3. Both are correct — 9.8 is the CVSS 3.1 base score, 9.3 is the CVSS 4.0 base score, per the NVD record. Same flaw, two scales.)

CVE-2026-115813 (CVSS 4.0 6.9 Medium; CVSS 3.1 5.8): SSRF in the model download path. The MMS management interface can be directed, via a crafted model URL, to send requests to unintended — including internal — network destinations. The 3.1 vector’s scope-change flag (S:C) is doing quiet work here: the vulnerable component reaches beyond its own security scope into the network behind it, which is how an SSRF in a model loader becomes cloud-credential theft via the instance metadata endpoint or a probe of internal services. Pair it with the bulletin’s shared condition: the management interface needs no login, so the SSRF is reachable by anyone who can reach the port. Readers of the October AWS Loom/SageMaker control-plane takeover will recognise the family — agent and serving control planes that accept instructions from the network without first asking who is speaking.

Why EOL model infrastructure is the real finding

The two CVEs are individually unremarkable — traversal in an extractor, SSRF in a downloader, both ancient bug classes. What makes this bulletin worth a briefing is the sentence underneath them: no fixed version is available. MMS shipped on GitHub, PyPI, and Docker Hub, which means it is still installable everywhere three facts are simultaneously true: the code is archived, the flaws are now public with NVD records, and the only remediation is a migration project nobody budgeted. Dead model-serving stacks do not disappear; they persist in internal demos, pinned Docker tags, batch-inference jobs nobody owns, and GPU hosts whose owners moved on. An unauthenticated 9.8 in software that cannot be patched is not a patching problem — it is an inventory problem. The action list is correspondingly short: search fleets and image registries for MMS artifacts and the management port, assume anything found is reachable, and retire it rather than firewalling it and hoping. A firewall rule is a control; a migration is a cure; only the second one survives the next bulletin about the software you forgot you were running.

Our verification was read-only. The bulletin ID, publication date, EOL status, affected versions, both CVE descriptions, and the unauthenticated-management-interface condition were read first-hand from the AWS security bulletin; both CVSS scores and vectors were read first-hand from the NVD API records (published 23 October 2026). We did not install MMS, download or extract any model archive, bind any management interface, or probe any deployment. Brave Search was used for discovery only.

Sources: