AWS won't patch CVSS 9.8 flaw in Multi Model Server

AWS published bulletin 2026-148-AWS covering two vulnerabilities in Multi Model Server: CVE-2026-115812 (CVSS 9.8, path traversal during model archive extraction with possible code execution) and CVE-2026-115813 (SSRF, 5.8). No fix is planned — the project is end-of-life, its repository was archived on November 20, 2025, and the MMS management interface requires no authentication.

• CVE-2026-115812: CVSS 9.8, files written outside extraction directory
• CVE-2026-115813: SSRF in the model download path, CVSS 5.8
• MMS management API has no authentication and listens on port 8081
• MMS repo archived November 20, 2025; no patched release planned