CVE-2026-47487: NVIDIA Triton Path Traversal Vulnerability

CVE-2026-47487 Overview

CVE-2026-47487 is a path traversal vulnerability [CWE-22] in NVIDIA Triton Inference Server for Linux. The flaw exists in the Triton MLflow plugin, which fails to sanitize path components supplied through the model name parameter. An authenticated local user can supply directory traversal sequences in the model name to read, write, or modify files outside the intended model repository. Successful exploitation can lead to denial of service and information disclosure. The vulnerability requires local access and low privileges but no user interaction.

Critical Impact
Local authenticated users can escape the model repository sandbox to access arbitrary files on the host, enabling information disclosure and potential tampering with Triton runtime files.

Affected Products

NVIDIA Triton Inference Server for Linux
Triton MLflow plugin component
Deployments exposing model management to multi-tenant users

Discovery Timeline

2026-08-04 - CVE-2026-47487 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-47487

Vulnerability Analysis

The vulnerability resides in the Triton MLflow plugin, which integrates the MLflow model registry with the Triton Inference Server. When a client submits a model management request, the plugin uses the supplied model name as part of a filesystem path within the model repository. The plugin does not validate or normalize the model name before joining it to the repository base path.

An attacker supplies traversal sequences such as ../ inside the model name field. The concatenated path resolves outside the model repository directory. The plugin then performs read, write, or modification operations against the resolved path using the privileges of the Triton server process.

The attack vector is local, meaning the attacker must already have a foothold on the host or valid credentials to the Triton management interface. Impact is bounded to confidentiality and availability at the low level, with no direct integrity impact recorded for the process itself, though file modification outside the repository is part of the described behavior.

Root Cause

The root cause is missing input validation on the model name parameter passed to the MLflow plugin. The code path builds a filesystem location by concatenating the model repository root with attacker-controlled data without canonicalization or containment checks. This is a classic [CWE-22] improper limitation of a pathname to a restricted directory.

Attack Vector

Exploitation requires local access with low-privilege credentials against the Triton management API. The attacker crafts a model registration or management call in which the model name contains traversal sequences pointing to a target path. The Triton process, typically running with elevated privileges to manage GPU resources and model files, then operates on files outside its intended scope.

Refer to the NVIDIA Product Security advisory 5860 for vendor technical details. No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-47487

Indicators of Compromise

Triton Inference Server log entries containing model names with .., /, or URL-encoded traversal sequences such as %2e%2e%2f.
Unexpected file reads, writes, or modifications by the Triton server process outside its configured --model-repository path.
MLflow plugin activity referencing model identifiers that do not correspond to any registered model in the MLflow tracking server.

Detection Strategies

Enable verbose logging on Triton and alert on model management API calls where the model name field contains path separators or dot-dot sequences.
Deploy filesystem auditing (auditd or equivalent) on the Triton host to record file access by the Triton process outside the model repository directory.
Correlate MLflow plugin activity with process-level file access telemetry to identify traversal attempts followed by out-of-scope file operations.

Monitoring Recommendations

Baseline normal model names and repository paths, then alert on deviations in filename structure.
Monitor the Triton server process for reads of sensitive host files such as /etc/shadow, SSH keys, or Kubernetes service account tokens.
Forward Triton and system audit logs to a centralized analytics platform for correlation across model management, filesystem, and identity events.

How to Mitigate CVE-2026-47487

Immediate Actions Required

Apply the NVIDIA security update referenced in NVIDIA Product Security bulletin 5860 as soon as it is available for your deployment.
Restrict access to the Triton management API to trusted operators and remove local shell access from users who do not require it.
Run the Triton server process under a dedicated low-privilege service account with filesystem access limited to the model repository.

Patch Information

Consult the NVIDIA Product Security repository entry for 5860 for the fixed version of Triton Inference Server and the corresponding MLflow plugin. Additional metadata is available in the NVD record for CVE-2026-47487 and the CVE.org record.

Workarounds

Disable the MLflow plugin in Triton if it is not required by your workload.
Deploy Triton inside a container or chroot environment so that traversal outside the model repository cannot reach host-sensitive files.
Enforce mandatory access controls such as SELinux or AppArmor profiles that confine the Triton process to the model repository directory tree.

bash

# Configuration example: run Triton with a confined model repository and no plugin access to MLflow
tritonserver \
  --model-repository=/srv/triton/models \
  --model-control-mode=explicit \
  --disable-auto-complete-config \
  --backend-config=mlflow,enable=false