CVE-2026-47478 Overview
CVE-2026-47478 affects NVIDIA Triton Inference Server for Linux. The vulnerability allows a remote attacker to cause the use of an expired file descriptor [CWE-910: Use of Expired File Descriptor]. Successful exploitation may lead to a denial of service condition, disrupting inference workloads served by the affected process.
The flaw is reachable over the network without authentication or user interaction. Attackers targeting exposed Triton endpoints can trigger the condition to degrade or interrupt model serving. Confidentiality and integrity remain unaffected, but availability impact is high.
Critical Impact
A remote, unauthenticated attacker can trigger denial of service against NVIDIA Triton Inference Server for Linux by causing the server to reference an expired file descriptor.
Affected Products
- NVIDIA Triton Inference Server for Linux
Discovery Timeline
- 2026-07-14 - CVE CVE-2026-47478 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-47478
Vulnerability Analysis
NVIDIA Triton Inference Server hosts and serves machine learning models over network protocols including HTTP and gRPC. The server relies on file descriptors to manage connections, model artifacts, and inter-process resources.
CVE-2026-47478 arises when the server continues to reference a file descriptor after it has been closed or released. Operations on the stale descriptor produce undefined behavior, ranging from failed I/O to process termination. The result is a denial of service that halts inference availability.
The vulnerability is network-reachable and requires no privileges or user interaction. Attackers can trigger the code path remotely against any exposed Triton endpoint.
Root Cause
The root cause is classified as CWE-910, Use of Expired File Descriptor. The server does not consistently invalidate or reassign descriptor references after a resource is closed. Subsequent read, write, or close operations act on a descriptor that no longer represents the intended resource, producing errors or process crashes.
Attack Vector
Exploitation occurs over the network against Triton's exposed inference endpoints. The attacker sends a sequence of requests that induces the server to close and then reuse a resource whose descriptor is still tracked internally. No authentication is required. See the NVD entry for CVE-2026-47478 and the CVE.org record for additional technical references.
Detection Methods for CVE-2026-47478
Indicators of Compromise
- Unexpected termination or restart of the tritonserver process on Linux hosts.
- Repeated EBADF errors or file descriptor exceptions in Triton server logs.
- Sudden drops in inference request throughput correlated with client connection bursts.
Detection Strategies
- Monitor Triton process lifecycle events and correlate crashes with inbound HTTP or gRPC request patterns.
- Inspect application logs for stack traces referencing closed sockets, expired handles, or descriptor reuse.
- Baseline normal request volumes against Triton endpoints and alert on anomalous request bursts from single sources.
Monitoring Recommendations
- Enable Triton server verbose logging and forward logs to a centralized analytics platform for correlation.
- Track container or systemd restart counts for Triton workloads as a health signal.
- Monitor open file descriptor counts per Triton process to identify leaks or exhaustion patterns.
How to Mitigate CVE-2026-47478
Immediate Actions Required
- Restrict network access to Triton Inference Server endpoints to trusted client networks only.
- Place Triton behind an authenticated reverse proxy or service mesh with request rate limiting.
- Review exposure of HTTP (8000), gRPC (8001), and metrics (8002) ports on production hosts.
Patch Information
Apply the security update from NVIDIA when available. Refer to the NVD entry for CVE-2026-47478 and the CVE.org record for CVE-2026-47478 for the latest vendor advisory links and fixed version details.
Workarounds
- Deploy Triton within isolated network segments accessible only to authorized inference clients.
- Enforce ingress filtering and rate limiting at load balancers to reduce abuse of exposed endpoints.
- Configure process supervisors to automatically restart crashed Triton instances while remediation is applied.
# Example: restrict Triton ports to an internal subnet using iptables
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8001 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
iptables -A INPUT -p tcp --dport 8001 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
