CVE-2026-47625: NVIDIA Triton Server Auth Bypass Flaw

CVE-2026-47625 Overview

CVE-2026-47625 is a missing authorization vulnerability [CWE-862] in NVIDIA Triton Inference Server for Linux. An attacker can abuse missing authorization checks over the network without authentication or user interaction. Successful exploitation can result in information disclosure, data tampering, and denial of service against the inference server. The vulnerability is reachable over the network with low attack complexity, making exposed Triton deployments a direct target for opportunistic attackers.

Critical Impact
Unauthenticated network attackers can trigger denial of service against NVIDIA Triton Inference Server instances, disrupting machine learning inference workloads.

Affected Products

NVIDIA Triton Inference Server for Linux
Specific affected versions: Not Available in NVD data
Refer to the NVIDIA product security advisory for version details

Discovery Timeline

2026-09-08 - CVE-2026-47625 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-47625

Vulnerability Analysis

The vulnerability originates in NVIDIA Triton Inference Server for Linux, a runtime that serves machine learning models over network APIs. Triton exposes endpoints for model management, inference execution, and server administration. A missing authorization check allows a remote attacker to reach functionality that should be restricted. The available NVD data indicates the primary demonstrated impact is on availability, meaning an attacker can disrupt inference workloads without credentials.

Because Triton is commonly deployed as a backend for production AI services, denial of service against the server directly interrupts dependent applications. The advisory language also references potential information disclosure and data tampering, indicating that authorized operations on the server may be reachable by unauthorized callers.

Root Cause

The root cause is a missing authorization control [CWE-862] on one or more server-side operations. The application does not verify that the caller is permitted to invoke the requested action before executing it. This design flaw removes the enforcement boundary between anonymous network clients and privileged server functionality.

Attack Vector

Exploitation occurs over the network against a reachable Triton endpoint. No authentication and no user interaction are required. An attacker sends a crafted request to a vulnerable API surface and triggers behavior that should require authorization. Triton deployments exposed to untrusted networks, including cloud workloads without network segmentation, are the highest-risk targets.

No verified public exploit code is available at this time. Technical detail is limited in the current advisory. See the NVIDIA product security repository and the NVD entry for CVE-2026-47625 for updated technical references.

Detection Methods for CVE-2026-47625

Indicators of Compromise

Unexpected inference request spikes or malformed requests to Triton HTTP or gRPC endpoints (default ports 8000, 8001, 8002)
Anomalous access to Triton management or model repository endpoints from external or non-application source IPs
Sudden termination, restart loops, or crashes of the tritonserver process on Linux hosts

Detection Strategies

Monitor Triton access logs for requests to administrative or model-control endpoints originating from clients that are not the expected inference consumers
Alert on Triton process crashes and container restarts correlated with inbound network traffic
Baseline normal inference request patterns and flag deviations in request volume, size, or endpoint distribution

Monitoring Recommendations

Ingest Triton server logs and host telemetry into a centralized analytics platform for correlation with network flow data
Track outbound and inbound connections to Triton ports across Kubernetes and cloud workloads
Enable audit logging on the model repository and configuration endpoints to capture unauthorized access attempts

How to Mitigate CVE-2026-47625

Immediate Actions Required

Restrict network access to Triton Inference Server endpoints using firewalls, security groups, or Kubernetes NetworkPolicies so only trusted clients can reach the service
Remove Triton instances from public network exposure and place them behind an authenticated API gateway or reverse proxy
Inventory all Triton deployments across Linux hosts, containers, and cloud environments and prioritize patching internet-facing instances

Patch Information

NVIDIA has published a security advisory for this issue. Review the NVIDIA product security advisory for CVE-2026-47625 and upgrade to the fixed version identified by NVIDIA for your platform. Confirm the deployed tritonserver version matches the vendor's remediated build before returning workloads to production.

Workarounds

Terminate TLS and enforce authentication at an upstream proxy such as NGINX or Envoy in front of Triton until patching is complete
Bind Triton listeners to loopback or internal interfaces only and use a sidecar proxy for authorized client access
Disable unused Triton endpoints, including model management APIs, if they are not required by production workloads

bash

# Configuration example: restrict Triton exposure with a Kubernetes NetworkPolicy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: triton-restrict-ingress
  namespace: inference
spec:
  podSelector:
    matchLabels:
      app: triton-inference-server
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: trusted-clients
      ports:
        - protocol: TCP
          port: 8000
        - protocol: TCP
          port: 8001