Flaw in AWS Multi Model Server Exposes Inference Infrastructure to Request Forgery

Key facts

The vulnerability cataloged as CVE-2026-115813 emerged from an assessment of Amazon Web Services (AWS) Multi Model Server, an open-source tool developed by AWS Labs to manage machine learning model inference. According to reporting by VulDB, the flaw specifically compromises the component of the software responsible for downloading model packages onto the host server.

Under normal operational conditions, Multi Model Server exposes management interfaces that permit systems engineers and automated pipelines to register, configure, and scale machine learning models dynamically. When a new model is introduced to the system, an operator supplies an address—typically a Uniform Resource Identifier (URI) or URL—pointing to where the packaged model archive is stored. The server software then processes that input, establishes an outbound network connection, and downloads the required files into its local cache before initializing the model worker processes.

In deployments affected by CVE-2026-115813, the input validation governing that download routine is insufficient. Because the server does not rigorously restrict the protocols, IP address ranges, or hostnames it accepts during the retrieval phase, an attacker capable of submitting requests to the management endpoint can specify malicious destinations. Instead of fetching an authorized model archive from a trusted storage bucket, the server can be commanded to issue internal HTTP requests to other machines on the private network or to link-local cloud management endpoints.

VulDB's entry notes that the flaw applies to all releases of Multi Model Server up to and including version 1.1.11. The database records the discovery as an active server-side request forgery (SSRF) risk, establishing that the threat stems from the server acting as an unintended proxy for outbound network calls.

Why it matters

The discovery of CVE-2026-115813 highlights persistent architectural risks at the intersection of enterprise cloud computing and artificial intelligence operations. Inference serving platforms represent critical junctions in modern IT environments: they frequently run inside private subnets, interface with sensitive backend databases, and possess broad network access to facilitate low-latency communication with other microservices. When an inference framework suffers from an SSRF vulnerability, the traditional assumption of perimeter network defense collapses.

In cloud environments such as AWS, SSRF vulnerabilities represent an acute operational threat. If an attacker can force a cloud-hosted server to make arbitrary HTTP requests, the primary target is often the instance metadata service. On AWS infrastructure, this service has historically been accessible at the link-local IP address 169.254.169.254. Querying that address allows an application to view instance properties and, crucially, obtain temporary security credentials associated with the host's Identity and Access Management (IAM) role. If an SSRF flaw allows unauthorized access to that endpoint, an attacker can extract security tokens and assume the privileges of the underlying cloud host, enabling unauthorized data access across the wider enterprise cloud footprint.

Beyond cloud credential risks, SSRF flaws allow threat actors to perform internal port scanning and map out corporate intranets that are entirely hidden from the public internet. Organizations that deploy machine learning frameworks often automate their model deployment pipelines via continuous integration and continuous deployment (CI/CD) systems. If those automated workflows interact with an unpatched Multi Model Server instance, unauthorized users could exploit the model registration process to stage lateral movement, access unprotected internal application programming interfaces (APIs), or tamper with proprietary operational data.

AWS Labs first introduced Multi Model Server in 2018 as an open-source, production-ready inference serving tool designed to address the operational challenges of deploying deep learning models at scale. Built primarily around Apache MXNet and later expanded to support PyTorch and the Open Neural Network Exchange (ONNX) format, Multi Model Server was engineered to host multiple models simultaneously on a shared pool of graphic processing units (GPUs) and central processing units (CPUs). By dynamically loading models into memory and scaling worker threads based on incoming inference traffic, the platform significantly reduced compute costs and operational overhead for enterprise AI teams.

As the machine learning ecosystem evolved, the foundational architecture of Multi Model Server gained substantial industry traction. In 2020, AWS partnered with the PyTorch team at Facebook (now Meta) to release TorchServe, an enterprise inference engine built directly upon the core code and architectural principles established by Multi Model Server. Consequently, architectural design choices and input-handling patterns introduced in Multi Model Server have influenced multiple generations of machine learning serving frameworks across the open-source community.

Server-side request forgery has long been recognized as a top-tier software security concern, earning a standalone category in the Open Web Application Security Project (OWASP) Top 10 list of web application security risks. The wider cloud industry experienced the catastrophic potential of SSRF during the 2019 Capital One data breach, where an attacker leveraged an SSRF vulnerability in a misconfigured web application firewall to query the AWS metadata service, compromise administrative credentials, and exfiltrate records belonging to more than 100 million individuals.

Following that incident, AWS introduced Instance Metadata Service Version 2 (IMDSv2) in November 2019. Unlike its predecessor, IMDSv2 requires callers to initiate a session and retrieve a cryptographic session token using an HTTP PUT request before fetching metadata, a design specifically intended to thwart simple SSRF exploits that rely on standard HTTP GET requests. However, IMDSv2 adoption remains optional or incomplete in many legacy environments, leaving systems vulnerable to SSRF attacks if individual applications fail to sanitize external network requests.

Reaction

Following the publication of the entry by VulDB, official public statements from Amazon Web Services or maintainers of the open-source repository have not yet been formally linked in the catalog record. In typical vulnerability disclosure workflows, software maintainers evaluate disclosed CVE entries through the Common Vulnerabilities and Exposures program, which is overseen by the MITRE Corporation alongside authorized CVE Numbering Authorities.

Within enterprise cloud environments, cybersecurity teams routinely monitor databases such as VulDB and the National Vulnerability Database (NVD), operated by the National Institute of Standards and Technology (NIST), to evaluate emerging threats against their software inventories. Because Multi Model Server is an open-source project hosted on GitHub, remediation typically occurs through pull requests submitted by maintainers or community contributors, accompanied by updated version tags and release documentation.

Security engineers tracking the disclosure are expected to assess whether their internal inference clusters expose Multi Model Server management endpoints to public networks or untrusted internal subnets. Standard hardening guidance from cloud security bodies universally recommends isolating administrative APIs on port 8081 or port 8444, enforcing strict egress network access control lists (NACLs) to block outbound connections to arbitrary IP ranges, and mandating IMDSv2 on all underlying EC2 virtual machines.

What we don't know yet

Several technical specifics regarding CVE-2026-115813 remain unconfirmed in the initial reporting from VulDB. The initial advisory does not provide a finalized Common Vulnerability Scoring System (CVSS) vector or base score, leaving the standardized mathematical measure of its severity and exploitability undetermined. Furthermore, the entry does not specify whether the vulnerability requires active administrative authentication to trigger, or if it can be exploited by an unauthenticated remote actor when management ports are reachable.

It is also unclear from the available disclosure whether an official patch has been published in a subsequent release beyond version 1.1.11, or if a temporary workaround exists for organizations unable to immediately upgrade their inference clusters. Finally, the advisory does not indicate whether CVE-2026-115813 has been observed being actively exploited in the wild, nor does it identify the security researcher or organization credited with reporting the flaw to maintainers.

What to watch

Organizations managing machine learning inference infrastructure should track several upcoming milestones to determine their exposure and remediation timeline:

This report is based on vulnerability intelligence published by VulDB.