CVE-2026-47606 in Triton Inference Server
Summary
by MITRE • 08/18/2026
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The NVIDIA Triton Inference Server, a widely adopted open-source solution for serving AI models at scale in production environments, is susceptible to an absolute path traversal vulnerability that poses significant risks to the integrity and confidentiality of machine learning deployments. This flaw resides within the server's handling of file system operations during model loading or configuration parsing processes. When the application receives input intended to specify a resource location, it fails to adequately sanitize or validate the provided path string against expected constraints. Consequently, an attacker can manipulate this input to reference files located outside the designated sandboxed directory structure by utilizing absolute paths that bypass standard access controls. This lack of strict boundary enforcement allows the server to read from or write to arbitrary locations on the host operating system where Triton is running.
The technical mechanism behind this vulnerability exploits the fundamental difference between relative and absolute path resolution in Unix-like systems. By supplying a path starting with a root directory indicator, such as forward slash followed by specific directories, an attacker can direct the server's internal file I/O operations to access sensitive configuration files, private keys, or other critical system artifacts that are not intended for public exposure. This behavior violates the principle of least privilege and proper isolation boundaries expected in containerized or sandboxed inference environments. The vulnerability is particularly dangerous because Triton often runs with elevated privileges depending on the deployment architecture, such as within Kubernetes pods or dedicated GPU servers, thereby amplifying the potential impact of any successful exploitation attempt.
The operational impact of this path traversal flaw extends beyond simple data leakage. A successful exploit can lead to information disclosure by allowing an attacker to read sensitive files containing database credentials, API keys, or proprietary model weights stored in accessible directories. More critically, if the server permits writing operations through similar mechanisms or if there are associated features that allow loading models from arbitrary paths with executable content, it could facilitate remote code execution. An adversary might overwrite a shared library or configuration file used by the inference process to inject malicious payloads, effectively gaining control over the underlying host system. This compromises not only the confidentiality and integrity of the AI services but also potentially impacts other workloads running on the same infrastructure due to lateral movement possibilities within compromised environments.
To mitigate this risk, immediate action is required at both the application configuration and deployment levels. Administrators should ensure that they are running a patched version of NVIDIA Triton Inference Server where this path validation logic has been corrected to strictly enforce relative paths or canonicalize inputs before processing. It is essential to review current model serving configurations to restrict file system access using operating-level security controls such as Linux capabilities, SELinux policies, or AppArmor profiles that limit the server's ability to traverse outside its designated working directory. Additionally, deploying the service within a containerized environment with read-only root filesystems and minimal privileges can significantly reduce the attack surface. Regular auditing of input validation routines in custom extensions or plugins integrated with Triton is also recommended to prevent similar flaws from being introduced through third-party code.
This vulnerability aligns with CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. From an offensive security perspective, it maps to the ATT&CK technique T1083, File and Directory Discovery, often used in conjunction with T1505.003, Server Software Component: Web Shell, if code execution is achieved through file upload or overwrite mechanisms. Understanding these mappings helps organizations prioritize remediation efforts based on established threat intelligence frameworks and industry best practices for securing AI infrastructure against exploitation attempts targeting input validation weaknesses.