CVE-2026-24147: NVIDIA Triton Server Info Disclosure Flaw

CVE-2026-24147 Overview

NVIDIA Triton Inference Server contains a path traversal vulnerability (CWE-22) in the triton server component where an attacker may cause information disclosure by uploading a maliciously crafted model configuration. A successful exploit of this vulnerability may lead to information disclosure or denial of service, potentially exposing sensitive server-side data or disrupting AI inference operations.

Critical Impact

Attackers can exploit this vulnerability to access sensitive files outside the intended directory structure or cause service disruption in AI/ML inference environments.

Affected Products

• NVIDIA Triton Inference Server (specific versions not disclosed)

Discovery Timeline

• 2026-04-07 - CVE-2026-24147 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-24147

Vulnerability Analysis

This vulnerability is classified as a path traversal flaw (CWE-22), which occurs when the application fails to properly sanitize user-supplied input used in file path construction. In the context of NVIDIA Triton Inference Server, the vulnerability manifests during the model configuration upload process. When an attacker uploads a specially crafted model configuration file, they can potentially manipulate file paths to access resources outside the intended model repository directory.

The network-accessible nature of this vulnerability means that remote attackers can potentially exploit it without requiring prior authentication. The attack complexity is relatively high, indicating that certain conditions must be met for successful exploitation. The potential impacts include unauthorized access to sensitive configuration files, model weights, or other server-side resources (information disclosure), as well as the ability to disrupt the inference service (denial of service).

Root Cause

The root cause of CVE-2026-24147 lies in insufficient input validation within the model configuration parsing logic. When processing model configuration files, the Triton Inference Server does not adequately sanitize path components that could contain directory traversal sequences such as ../ or absolute paths. This allows an attacker to craft a model configuration that references files outside the designated model repository, leading to unauthorized file access or resource manipulation.

Attack Vector

The attack vector is network-based, requiring the attacker to have the ability to upload or submit model configurations to the Triton Inference Server. The attack flow involves crafting a malicious model configuration file containing path traversal sequences in file reference fields, submitting this configuration through the server's model management interface, and when the server processes the configuration, the manipulated paths cause access to unauthorized files or resources outside the model repository.

The vulnerability does not require user interaction, though the high attack complexity suggests that specific server configurations or timing conditions may need to be present for successful exploitation. For detailed technical information, refer to the NVIDIA Support Article.

Detection Methods for CVE-2026-24147

Indicators of Compromise

• Unusual model configuration uploads containing path traversal patterns such as ../, ..\\, or absolute file paths
• Unexpected file access events outside the designated model repository directories
• Error logs indicating attempts to access restricted file system locations
• Anomalous network traffic patterns to the Triton Inference Server model management endpoints

Detection Strategies

• Implement file integrity monitoring on the Triton Inference Server installation directories and model repositories
• Deploy network intrusion detection rules to identify model configuration uploads containing traversal sequences
• Enable detailed audit logging for model management operations and file access events
• Monitor for unusual patterns in model loading failures or configuration parsing errors

Monitoring Recommendations

• Configure centralized logging for all Triton Inference Server instances to capture model management activities
• Establish baseline metrics for normal model upload and configuration patterns to detect anomalies
• Implement alerting for any file access attempts outside authorized directories
• Regularly review server logs for evidence of exploitation attempts or reconnaissance activity

How to Mitigate CVE-2026-24147

Immediate Actions Required

• Review and update NVIDIA Triton Inference Server to the latest patched version as recommended by NVIDIA
• Restrict network access to the Triton Inference Server model management interfaces using firewall rules and network segmentation
• Implement strict input validation on any systems that submit model configurations to the server
• Audit existing model configurations for any suspicious path references

Patch Information

NVIDIA has published a security advisory addressing this vulnerability. Organizations should consult the NVIDIA Support Article for specific patch information and upgrade guidance. Review the NVD CVE-2026-24147 Detail page for additional technical details and updates.

Workarounds

• Implement network-level access controls to restrict model configuration uploads to trusted sources only
• Deploy a Web Application Firewall (WAF) or API gateway with rules to detect and block path traversal patterns in requests
• Run Triton Inference Server in a containerized environment with strict file system isolation and read-only mounts where possible
• Implement application-level input validation to sanitize all model configuration fields before processing

# Example: Restrict model repository access using container isolation
# Run Triton with read-only model repository mount
docker run --rm \
  -p 8000:8000 -p 8001:8001 -p 8002:8002 \
  --read-only \
  -v /path/to/models:/models:ro \
  nvcr.io/nvidia/tritonserver:latest tritonserver \
  --model-repository=/models