CVE-2026-24208: Nvidia Triton Inference Server Path Traversal

CVE-2026-24208 Overview

CVE-2026-24208 is a path traversal vulnerability [CWE-22] in NVIDIA Triton Inference Server. An unauthenticated remote attacker can manipulate file path inputs to access resources outside the intended directory. A successful exploit can lead to denial of service against the inference server. The vulnerability is exploitable over the network without privileges or user interaction. NVIDIA has issued a security bulletin and corresponding patch through its customer support portal.

Critical Impact

Remote, unauthenticated attackers can trigger a path traversal condition in NVIDIA Triton Inference Server, resulting in denial of service of AI inference workloads.

Affected Products

• NVIDIA Triton Inference Server (versions prior to the fix referenced in NVIDIA Security Bulletin ID 5828)
• Linux distributions running affected Triton Inference Server builds
• Containerized AI inference deployments hosting vulnerable Triton releases

Discovery Timeline

• 2026-05-20 - CVE-2026-24208 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-24208

Vulnerability Analysis

NVIDIA Triton Inference Server is an open-source platform that serves machine learning models across frameworks such as TensorFlow, PyTorch, and ONNX. The vulnerability allows an attacker to submit crafted input that includes directory traversal sequences. The server fails to properly canonicalize or validate the supplied path before using it for file operations. Triggering the flaw results in availability loss, consistent with the impact-only profile of the issue (no confidentiality or integrity compromise). Because Triton typically serves inference traffic over network endpoints, the attack surface includes any reachable HTTP, gRPC, or management interface. Organizations running Triton in production AI pipelines should treat the issue as high priority due to the potential disruption of dependent applications.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory, classified under [CWE-22]. The server accepts user-controlled path components that can include traversal sequences such as ../ segments. Without strict normalization, these inputs reach file system operations and reference resources outside the intended model or configuration directory.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted request to an exposed Triton endpoint containing manipulated path parameters. The server processes the malformed path and enters a state that disrupts inference handling. No public proof-of-concept code or exploit has been published as of the disclosure date.

The vulnerability manifests in the path handling logic of Triton Inference Server request processing. See the NVIDIA Support Answer for vendor-supplied technical details.

Detection Methods for CVE-2026-24208

Indicators of Compromise

• HTTP or gRPC requests to Triton endpoints containing ../, ..\, or URL-encoded traversal sequences (%2e%2e%2f) in path parameters
• Unexpected Triton Inference Server process crashes or restarts correlated with inbound requests
• Error logs referencing file access failures outside configured model repository paths

Detection Strategies

• Inspect web application firewall and reverse proxy logs in front of Triton endpoints for traversal patterns in request URIs and JSON payloads
• Monitor Triton server logs for repeated request handling errors and abnormal termination events
• Baseline normal model repository file access and alert on access attempts targeting unrelated paths on the host

Monitoring Recommendations

• Forward Triton Inference Server logs and host telemetry to a centralized SIEM for correlation with network traffic
• Track availability metrics of inference endpoints to detect denial-of-service conditions quickly
• Alert on network exposure changes that place Triton management interfaces on untrusted networks

How to Mitigate CVE-2026-24208

Immediate Actions Required

• Apply the NVIDIA-supplied update referenced in NVIDIA Security Bulletin 5828 to all Triton Inference Server deployments
• Restrict network access to Triton HTTP, gRPC, and management endpoints to trusted clients only
• Audit existing deployments for internet-exposed Triton instances and remove unnecessary exposure

Patch Information

NVIDIA has published guidance and fixed builds through the official advisory at NVIDIA Support Answer 5828. Administrators should upgrade to the version specified in the bulletin. Container-based deployments should pull updated official NVIDIA images and redeploy. Confirm version after upgrade and re-run application-level integration tests against inference endpoints.

Workarounds

• Place Triton Inference Server behind an authenticated reverse proxy that validates and normalizes request paths
• Deploy WAF rules that block requests containing directory traversal sequences targeting Triton endpoints
• Run Triton with the least-privilege service account and a read-only model repository mount to limit file system reach

# Example nginx reverse proxy rule to block traversal sequences before reaching Triton
location /v2/ {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 400;
    }
    proxy_pass http://triton-backend:8000;
}