Menu

1 / 3

AWS Won't Patch a CVSS 9.8 Bug in Multi Model Server. Its Management API Has No Login

DEV Community: aws·Gabriel Anhaia·2 days ago
#a0FgMkzQ
#devtoaws#devto#dev#path#root
Reading 0:00
15s threshold

Book: Ship It — the pragmatic startup tech stack

Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go

My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools

Me: xgabriel.com | GitHub

On October 23, AWS published security bulletin 2026-148-AWS for two vulnerabilities in Multi Model Server (MMS), its open-source tool for serving ML models. Every released version ( <=1.1.11 ) is affected, and the bulletin says "no fixed version is available or planned on any distribution channel."

The worse of the two, CVE-2026-115812, is rated 9.8 on CVSS 3.1 and 9.3 on CVSS 4.0, according to Strix's CVE record .…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.