CVE-2026-47487 in Triton Inference Server
Summary
by MITRE • 08/04/2026
NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of service and information disclosure.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
The NVIDIA Triton Inference Server presents a critical path traversal vulnerability within its MLflow plugin implementation that allows unauthorized file system access beyond the designated model repository boundaries. This flaw stems from insufficient input validation and sanitization of model names, particularly when processing paths that contain directory traversal sequences such as "../" or similar constructs. The vulnerability specifically affects the server's handling of model identifiers in MLflow plugin contexts where user-provided input directly influences file system operations without proper path normalization or access control enforcement.
The technical execution of this vulnerability occurs through the MLflow plugin's interpretation of model names that contain malicious path traversal sequences, enabling attackers to bypass intended repository boundaries and access arbitrary files on the system. When a user submits a model name containing traversal characters, the Triton server fails to properly sanitize these inputs before performing file operations, leading to unauthorized read, write, or modification access to files outside the designated model repository directory structure. This represents a classic path traversal vulnerability classified under CWE-22, which occurs when untrusted input is used to construct file paths without proper validation or sanitization mechanisms.
The operational impact of this vulnerability extends beyond simple information disclosure to encompass potential system compromise and service disruption. An attacker could leverage this flaw to read sensitive configuration files, access system credentials stored in accessible locations, modify model artifacts to introduce malicious code execution payloads, or perform destructive operations that could lead to complete denial of service for the inference server. The vulnerability exposes the underlying file system to unauthorized access patterns that should be strictly confined to the intended repository boundaries, potentially allowing attackers to escalate privileges or access confidential data from other parts of the system where models might be stored.
Security controls and mitigation strategies should focus on implementing robust input validation and path sanitization mechanisms within the MLflow plugin component. The recommended approach involves normalizing all model name inputs through canonical path resolution that strips or rejects directory traversal sequences, enforcing strict access control policies that prevent file operations outside designated repository boundaries, and implementing comprehensive logging of file system operations for monitoring suspicious access patterns. Organizations should also consider applying the principle of least privilege to the Triton server processes, limiting their file system access to only necessary directories while ensuring proper authentication and authorization controls are in place. This vulnerability aligns with ATT&CK technique T1059.007 for command and scripting interpreter usage combined with T1566.002 for phishing via social media, as attackers might exploit this weakness through crafted model names submitted via API endpoints or MLflow integration points.