AmazonAnalysisAmazon Web Services issues security advisory for unpatched Multi Model Server flaws
What happened.Amazon Web Services published security bulletin AWS-2026-148 warning users of two high-severity vulnerabilities affecting all releases of its open-source Multi Model Server framework.
Why it matters.Machine learning inference servers host proprietary model weights and connect directly to internal data pipelines. Unauthenticated path traversal on inference servers gives intruders immediate access to underlying cloud environments. Engineering teams operating legacy model endpoints must migrate to maintained inference engines and restrict management interfaces to private networks.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-115812 with a 9.8 CVSS score, a path traversal flaw during model archive extraction permits arbitrary file writes leading to remote code execution.
- Exploitation path: A secondary flaw tracked as CVE-2026-115813 allows unauthenticated callers accessing the exposed management API to trigger server-side request forgery against internal cloud resources.
- Remediation guidance: Because the Multi Model Server project reached end-of-life status, AWS will not publish software patches and urged engineering teams to migrate model workloads to TorchServe.
STORYLINE PROGRESSION & CONTEXT
This report represents a verified evolution of prior newsroom intelligence: