CVE-2026-47606: NVIDIA Triton Path Traversal Flaw

CVE-2026-47606 Overview

CVE-2026-47606 is an absolute path traversal vulnerability in NVIDIA Triton Inference Server for Linux. An unauthenticated attacker with network access can supply absolute file paths that the server processes outside of its intended directory boundaries. Successful exploitation may lead to code execution and information disclosure, according to the NVIDIA advisory. The flaw is categorized under CWE-36: Absolute Path Traversal and affects Linux deployments of the Triton Inference Server used to host machine learning models in production environments.

Critical Impact
Network-adjacent attackers can traverse the file system using absolute paths, potentially reading sensitive files or executing code within the Triton server context.

Affected Products

NVIDIA Triton Inference Server for Linux
Machine learning inference deployments exposing Triton HTTP or gRPC endpoints
Container images and Kubernetes workloads packaging vulnerable Triton versions

Discovery Timeline

2026-08-18 - CVE-2026-47606 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-47606

Vulnerability Analysis

The vulnerability resides in file path handling logic within the Triton Inference Server. The server accepts input containing absolute file system paths without properly restricting them to expected directories. An attacker who can reach the Triton network endpoint can supply crafted paths that reference arbitrary locations on the underlying Linux host.

The NVIDIA advisory notes the flaw is reachable over the network without authentication or user interaction. Attack complexity is low, and no privileges are required to initiate the request. The impact is scoped to confidentiality and integrity, with successful exploitation potentially allowing an attacker to read files accessible to the Triton process or influence file operations that lead to code execution.

With an EPSS score of 0.409%, active exploitation is not currently forecast. However, Triton servers are often deployed in environments handling proprietary models and sensitive training data, raising the practical impact of information disclosure.

Root Cause

The root cause is improper input validation of file path parameters. The server processes absolute paths supplied through its API without canonicalizing them or enforcing a chroot-style boundary. This is a classic [CWE-36] weakness where the application trusts caller-supplied path input.

Attack Vector

An attacker sends an unauthenticated request to a reachable Triton endpoint containing an absolute path such as /etc/passwd or a path pointing to model artifacts, configuration files, or writable locations. The server resolves the path against the host file system rather than a restricted model repository directory. Depending on the code path invoked, this may return file contents to the caller or cause the server to load a malicious artifact leading to code execution. Refer to the NVIDIA product security advisory for vendor-specific technical detail.

Detection Methods for CVE-2026-47606

Indicators of Compromise

HTTP or gRPC requests to Triton endpoints containing absolute paths beginning with /etc/, /root/, /var/, or /proc/
Triton process accessing files outside its configured model repository directory
Unexpected outbound connections or child processes spawned by the tritonserver binary
Log entries showing model load operations referencing paths outside the standard repository

Detection Strategies

Inspect Triton access logs for API parameters carrying absolute paths or path traversal sequences
Correlate file open events by the tritonserver process against an allowlist of the configured model repository
Alert on new process execution originating from the Triton service account
Baseline normal API usage patterns and flag requests referencing filesystem paths

Monitoring Recommendations

Forward Triton application logs and Linux audit records into a centralized analytics platform for retention and query
Enable Linux auditd rules on sensitive directories such as /etc/, /root/, and ~/.ssh/ to detect reads by the Triton process
Monitor network egress from inference nodes for unexpected destinations that may indicate data exfiltration

How to Mitigate CVE-2026-47606

Immediate Actions Required

Apply the fixed NVIDIA Triton Inference Server release referenced in the NVIDIA product security bulletin
Restrict network exposure of Triton HTTP and gRPC endpoints to trusted client networks only
Run Triton as a non-root user with a minimal file system view via containerization
Audit configured model repositories and remove any writable paths accessible to untrusted callers

Patch Information

NVIDIA published this vulnerability under advisory bulletin 5865. Consult the NVIDIA product security repository for the specific fixed versions and upgrade guidance. Additional record data is available in the NVD entry and the CVE.org record.

Workarounds

Place Triton behind an authenticating reverse proxy that inspects and rejects request parameters containing absolute paths or .. sequences
Deploy Triton inside a container with a read-only root filesystem and bind-mount only the intended model repository
Apply Linux Mandatory Access Control profiles such as AppArmor or SELinux to constrain file access by the tritonserver process

bash

# Example: run Triton with a read-only root filesystem and a scoped model mount
docker run --rm \
  --read-only \
  --user 1000:1000 \
  --network internal \
  -v /srv/triton/models:/models:ro \
  nvcr.io/nvidia/tritonserver:<patched-tag> \
  tritonserver --model-repository=/models --strict-model-config=true