Threat Intelligence Database

Bulletin ID: 2026-148-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 10:30 AM PDT Description: Amazon Web Services Multi Model Server (MMS) is an open source tool for serving machine learning models for inference. It was published by AWS on GitHub, PyPI, and Docker Hub, and reached end of life; its source repository has been archived and read-only since November 20, 2025. CVE-2026-115812: An issue in model archive extraction could allow a crafted model archive to write files outside the intended directory, potentially resulting in code execution with the privileges of the MMS process. CVE-2026-115813: An issue in the model download path could allow the MMS management interface to be directed to make requests to unintended network destinations. Impacted versions: <=1.1.11 (all released versions) Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article

CVE-2026-115813 is a server-side request forgery (SSRF) vulnerability in AWS Multi Model Server version 1.1.11 and earlier. This flaw allows remote attackers to send requests to internal network destinations by exploiting the model download path with a crafted URL. The product is end-of-life with no fixed version available. Users are advised to discontinue use and migrate to supported model serving solutions. The vulnerability has a medium severity with a CVSS score of 5.8.

A race condition vulnerability (CWE-362) exists in tokio-rs tokio version 1.54.0 involving improper synchronization between tokio::time::Interval::poll_tick and the multi-threaded runtime's time driver. This can cause use-after-free issues leading to assertion panics, task reference-count corruption, or heap memory corruption. The issue is fixed in version 1.54.1.

CVE-2026-110975 is a vulnerability in Kruize Autotune where its REST API lacks authentication, exposing sensitive datasource credentials such as passwords, bearer tokens, API keys, and OAuth2 client secrets in cleartext. These secrets are returned by certain API endpoints to any client with network access, allowing credential harvesting. The vulnerability affects versions from 0 up to but not including 0.11.2. It has a high severity with a CVSS score of 7.4.

Microsoft announced that Windows Server 2016 will reach its end of support in January 2027, after which it will no longer receive security updates or patches.

Quest Diagnostics, a major American clinical laboratory company, disclosed a data breach involving unauthorized access to its Quanum LSM system, resulting in exposure of patient records. The breach was confirmed publicly but specific technical details and affected versions were not provided. No known exploits or active attacks have been reported. The incident highlights risks to sensitive healthcare data due to unauthorized system access.

University Hospital in Ohio has taken its IT systems offline after detecting unusual server activity indicative of a potential security breach. The incident was reported on October 23, 2026, and involves the hospital's digital services being shut down as a precautionary measure. No specific technical details or confirmed exploits have been disclosed at this time.

Node.js versions 22.x, 24.x, and 26.x contain a vulnerability in TLS hostname verification where server certificates can be incorrectly validated against a different IP address when the host is specified as a non-canonical IPv4 literal with leading zeros. This occurs because the hostname normalization interprets leading-zero octets as octal, while the OS resolver interprets them as decimal, potentially allowing a server to be authenticated with a certificate issued for another IP address.

CVE-2026-105481 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Node.js HTTP Agent connection reuse mechanism. It allows a client to mistakenly accept a response sent before the corresponding request, due to incomplete handling of unsolicited responses on keep-alive sockets. This flaw affects Node.js versions 22.23.3, 24.22.0, and 26.12.0.

Node.js versions 22.23.3, 24.22.0, and 26.12.0 contain a vulnerability in DNS resolution functions where hostnames with embedded NUL bytes are truncated silently. This allows dns.resolve*() and dns.reverse() to resolve a different hostname than the one validated, potentially bypassing domain allowlist checks.