CVE-2026-115813

Unsupported AWS Multi Model Server accepts unintended model-download destinations

AWS · Multi Model Server

First documented disclosure · Review checkpoint

Summary

A model URL can direct the server to internal network destinations.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: Vendor disclosure; malicious exploitation and confirmed victim compromise are not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The model-download path accepts URLs without an adequate destination allowlist.

Conditions required

The actor can reach the unauthenticated management interface and supply a model archive or URL. Risk rises when management binds to a network-accessible address.

Potential impact

Server-side requests to internal or otherwise unintended network destinations; actual victim data theft is not established.

Affected versions and configurations

All released MMS versions through 1.1.11.

Fix and mitigation status

None available or planned: MMS is end of life.

Practical next steps

Migrate to a supported model server. Temporarily isolate management to loopback where separate ports permit; shared-port SageMaker-style configurations require trusted-only access while migrating.

Operating lesson

Unsupported inference infrastructure needs a replacement plan, not an assumed future patch.

Evidence and limits

AWS disclosed both distinct weaknesses October 23; later registry modifications do not reset that date. AWS says the repository was archived November 20, 2025. Its shared-port configuration cannot move management alone to loopback. CNA scores use CVSS 4.0; reviewed sources do not establish exploitation.

Sources