CVE-2026-47630: NVIDIA Triton Path Traversal Vulnerability

CVE-2026-47630 Overview

CVE-2026-47630 is an absolute path traversal vulnerability in NVIDIA Triton Inference Server for Linux. An authenticated local attacker can supply crafted absolute paths that the server processes without proper validation. Successful exploitation may lead to code execution in the context of the Triton service.

The issue is classified as [CWE-36: Absolute Path Traversal]. It requires local access and low privileges, and does not require user interaction. The vulnerability affects the confidentiality of data processed by the inference server. Organizations running Triton to serve machine learning models on shared Linux hosts should treat this as a priority fix.

Critical Impact
Local attackers with low privileges can traverse the file system using absolute paths, potentially reading sensitive files and executing code within the Triton Inference Server process.

Affected Products

NVIDIA Triton Inference Server for Linux
Specific affected versions: refer to the NVIDIA Security Review
Deployments on shared Linux hosts and containerized inference platforms

Discovery Timeline

2026-08-18 - CVE-2026-47630 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-47630

Vulnerability Analysis

NVIDIA Triton Inference Server exposes APIs and interfaces that accept file path parameters for model repositories, configuration files, and related artifacts. The vulnerability arises when the server accepts absolute paths from callers without validating that the resolved path stays inside an approved directory. This allows a local attacker to reference arbitrary files on the host by supplying a fully qualified path such as /etc/shadow or a path under a directory the Triton process can read or write.

Because Triton loads and processes model artifacts, an attacker who can influence which files the server opens may be able to substitute a malicious model or configuration. The advisory notes that successful exploitation might lead to code execution, consistent with attacker-controlled files being deserialized or loaded as executable model backends. The impact is scoped to the privileges of the Triton service account.

Root Cause

The root cause is missing normalization and containment of user-supplied file paths. Instead of rejecting absolute paths or forcing all path lookups to occur relative to a fixed model repository root, the server resolves the supplied string directly against the local file system. This maps to [CWE-36] and is a known anti-pattern in services that expose file references over an API.

Attack Vector

The attack requires local access to the host or to an authenticated Triton interface reachable from the local scope. An attacker with low privileges submits a request containing an absolute path targeting a sensitive file or a location where the attacker can plant a malicious model artifact. No user interaction is required. Exploitation is deterministic once the attacker can reach the vulnerable interface.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the NVIDIA Security Review for vendor-specific technical details.

Detection Methods for CVE-2026-47630

Indicators of Compromise

Triton Inference Server log entries showing model load or file access using absolute paths outside the configured model repository root
Unexpected read attempts against sensitive files such as /etc/passwd, /etc/shadow, private keys, or configuration files by the Triton process
New or modified model files, config.pbtxt, or backend shared objects in unexpected filesystem locations
Child processes spawned by the Triton service that do not match normal inference workloads

Detection Strategies

Audit Triton API request logs for path parameters beginning with / or containing .. sequences, and alert on values that resolve outside the model repository.
Enable Linux auditd rules on the Triton service account to record open, openat, and execve syscalls against sensitive directories.
Correlate model load events with the on-disk model repository inventory to identify loads that reference files outside expected locations.

Monitoring Recommendations

Forward Triton application logs and host audit logs to a centralized analytics platform for retention and correlation.
Baseline normal file access patterns for the Triton service account and alert on deviations, especially reads of credential or key material.
Monitor process lineage from the Triton binary for unexpected shell or interpreter execution.

How to Mitigate CVE-2026-47630

Immediate Actions Required

Apply the fixed NVIDIA Triton Inference Server release identified in the NVIDIA Security Review.
Restrict local and network access to Triton management interfaces to trusted operators only.
Run Triton under a dedicated low-privilege service account with no read access to secrets or user home directories.
Review recent Triton logs for path parameters that reference absolute paths outside the model repository.

Patch Information

Refer to the vendor advisory at the NVIDIA Security Review for the list of fixed versions and upgrade guidance. Additional record details are available on the NVD CVE-2026-47630 page and the CVE.org record.

Workarounds

Deploy Triton inside a container or systemd unit with strict filesystem confinement, exposing only the model repository as a read-only mount.
Apply mandatory access controls such as AppArmor or SELinux profiles that limit the Triton process to its model repository and required libraries.
Enforce network segmentation so that only authorized clients can reach Triton APIs, reducing the pool of potential local attackers on multi-tenant hosts.

bash

# Configuration example: restrict Triton to a dedicated model repository
# and drop privileges via systemd

[Service]
User=triton
Group=triton
ExecStart=/opt/tritonserver/bin/tritonserver \
    --model-repository=/srv/triton/models \
    --strict-model-config=true
ProtectSystem=strict
ProtectHome=true
ReadOnlyPaths=/srv/triton/models
NoNewPrivileges=true
PrivateTmp=true
CapabilityBoundingSet=