Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| AWS | multi-model-server | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 23 Oct 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal network destinations via a crafted model URL. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution. | |
| Title | Server-side request forgery in the model download path in Amazon Web Services Multi Model Server | |
| First Time appeared |
Aws
Aws multi-model-server |
|
| Weaknesses | CWE-918 | |
| CPEs | cpe:2.3:a:aws:multi-model-server:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Aws
Aws multi-model-server |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: AMZN
Published:
Updated: 2026-10-23T17:35:14.102Z
Reserved: 2026-10-23T16:08:53.827Z
Link: CVE-2026-115813
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-23T18:17:21.617
Modified: 2026-10-23T18:17:21.617
Link: CVE-2026-115813
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-23T18:30:02Z
-
CWE-918
Server-Side Request Forgery (SSRF)