CVE-2026-47627: NVIDIA Triton Path Traversal Vulnerability

CVE-2026-47627 Overview

CVE-2026-47627 is a path traversal vulnerability affecting NVIDIA Triton Inference Server for Linux. An unauthenticated network attacker can manipulate file path inputs to access resources outside intended directories. Successful exploitation may lead to denial of service against the inference server. The weakness is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

NVIDIA Triton Inference Server is widely deployed to serve machine learning and AI models in production environments. A disruption of these services can halt downstream applications that depend on real-time inference. Refer to the NVIDIA Security Bulletin for vendor guidance.

Critical Impact
A remote, unauthenticated attacker can trigger path traversal on Triton Inference Server for Linux, leading to denial of service against AI inference workloads.

Affected Products

NVIDIA Triton Inference Server for Linux
Deployments serving models through Triton's HTTP and gRPC endpoints
Containerized Triton instances running on Kubernetes and other orchestrators

Discovery Timeline

2026-08-18 - CVE-2026-47627 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-47627

Vulnerability Analysis

The vulnerability resides in how Triton Inference Server handles user-supplied path components when servicing requests. An attacker submits crafted input that includes directory traversal sequences such as ../ to escape the intended base directory. The server processes the manipulated path without sufficient canonicalization or validation.

Successful exploitation lets the attacker reference files or resources outside the model repository directory. NVIDIA's advisory notes the primary observed impact is denial of service, likely through operations on unexpected paths that cause the process to fail or become unresponsive. The attack requires no authentication and no user interaction over the network.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory, tracked as CWE-22. Triton accepts path-related input without normalizing traversal sequences before file system operations. This allows attacker-controlled input to resolve to arbitrary locations reachable by the server process.

Attack Vector

The attack vector is network-based. An attacker sends crafted requests to a reachable Triton Inference Server endpoint, embedding traversal sequences in fields that influence file or resource lookups. Because Triton is often exposed within internal AI service meshes, any attacker with network reachability to the inference endpoint can attempt exploitation.

No verified public proof-of-concept code is available for CVE-2026-47627. See the NVIDIA product security repository and the NVD entry for authoritative technical details.

Detection Methods for CVE-2026-47627

Indicators of Compromise

HTTP or gRPC requests to Triton endpoints containing ../, ..\, encoded traversal sequences (%2e%2e%2f), or absolute paths in model name, version, or file fields
Unexpected Triton process crashes, restarts, or health-check failures correlated with malformed inbound requests
File access errors in Triton logs referencing paths outside the configured model repository

Detection Strategies

Inspect Triton access logs for request parameters containing traversal patterns and log entries showing file access outside the model repository root
Deploy web application firewall or API gateway rules that block encoded and unencoded path traversal sequences targeting /v2/models/ and related Triton routes
Correlate inference endpoint anomalies with process restarts using runtime telemetry from the host or container

Monitoring Recommendations

Track availability and error-rate metrics for Triton HTTP (:8000) and gRPC (:8001) endpoints to identify denial-of-service conditions early
Forward Triton container and host logs to a centralized analytics platform and alert on repeated 4xx/5xx responses from single sources
Monitor outbound and lateral network activity from Triton hosts to detect follow-on activity after a service disruption

How to Mitigate CVE-2026-47627

Immediate Actions Required

Apply the fixed Triton Inference Server version identified in the NVIDIA Security Bulletin as soon as it is available
Restrict network access to Triton endpoints so only trusted application tiers can reach the HTTP and gRPC ports
Audit exposed Triton deployments, including containerized instances behind ingress controllers, for internet reachability

Patch Information

NVIDIA publishes fixed versions and remediation guidance through its product security advisory. Consult the NVIDIA product security repository entry for advisory 5865 for the specific fixed releases and upgrade instructions. Cross-reference the CVE.org record for CVE-2026-47627 for status updates.

Workarounds

Place Triton behind an authenticated reverse proxy or API gateway that validates and normalizes path parameters before forwarding requests
Enforce network segmentation and mutual TLS between clients and Triton to prevent unauthenticated request delivery
Run Triton as a non-privileged user in a container with a read-only file system where feasible, limiting the impact of any file resolution outside the model repository

bash

# Example: restrict Triton exposure with iptables and run with least privilege
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8001 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
iptables -A INPUT -p tcp --dport 8001 -j DROP

# Run Triton container as non-root with read-only root filesystem
docker run --rm \
  --user 1000:1000 \
  --read-only \
  --tmpfs /tmp \
  -v /srv/models:/models:ro \
  -p 10.0.0.10:8000:8000 -p 10.0.0.10:8001:8001 \
  nvcr.io/nvidia/tritonserver:<patched-version> \
  tritonserver --model-repository=/models