CVE-2026-115813: CWE-918 Server-Side request forgery (SSRF) in AWS multi-model-server
Description
CVE-2026-115813 is a server-side request forgery (SSRF) vulnerability in AWS Multi Model Server version 1.1.11 and earlier. This flaw allows remote attackers to send requests to internal network destinations by exploiting the model download path with a crafted URL. The product is end-of-life with no fixed version available. Users are advised to discontinue use and migrate to supported model serving solutions. The vulnerability has a medium severity with a CVSS score of 5.8.
CVSS v3.1
Score 5.8medium
Affected software
AWS
multi-model-server
pkg:github/awslabs/multi-model-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-115813) involves server-side request forgery (CWE-918) in the model download path of AWS Multi Model Server versions up to 1.1.11. An attacker can craft a model URL that causes the server to send unauthorized requests to internal network resources. AWS Multi Model Server is end-of-life, and no fixed version exists. AWS recommends discontinuing use and migrating to other supported solutions. The CVSS v3.1 base score is 5.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, with a confidentiality impact limited to partial data disclosure.
Potential Impact
An attacker can remotely exploit this SSRF vulnerability to make the server send requests to internal network destinations, potentially exposing internal resources or data. The impact is limited to partial confidentiality loss without integrity or availability impact. No known exploits are reported in the wild.
Mitigation Recommendations
Since AWS Multi Model Server is end-of-life and no fixed version is available, AWS advises users to discontinue use of this product and migrate to a supported model serving solution. No official patch exists. Users should follow AWS guidance for migration and avoid running vulnerable versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AMZN
- Date Reserved
- 2026-10-23T16:08:53.827Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Is Cloud Service
- true
- Vendor Advisory Urls
- [{"url":"https://aws.amazon.com/security/security-bulletins/2026-148-aws/","vendor":"AWS"}]
Threat ID: 6adb9e84d73cc49347ad6669
Added to database: 10/23/2026, 17:51:00 UTC
Last enriched: 10/23/2026, 18:05:09 UTC
Last updated: 10/23/2026, 18:07:36 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.