Description

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal. A successful exploit might lead to denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-18T19:16:51.290Z",
  "pubdate": "2026-08-18T19:16:51.290Z",
  "executiveSummary": "A path traversal vulnerability exists within the NVIDIA Triton Inference Server for Linux, arising from insufficient sanitization of user-supplied input used in file system operations. This security flaw allows a remote or local attacker to manipulate file paths and access unauthorized resources outside the intended directory structure. Successful exploitation of this vulnerability directly impacts system availability, potentially resulting in a localized denial of service condition through resource exhaustion, application crashes, or the disruption of critical inference pipelines. The affected product is the NVIDIA Triton Inference Server running on Linux environments. While the precise attacker capabilities and execution prerequisites are constrained by the specific context of the input processing mechanism, the flaw inherently increases the risk profile of deployments exposed to untrusted inputs. Organizations utilizing the affected software face operational disruption if malicious payloads are successfully processed by the vulnerable component. Remediation requires applying official vendor patches or updating to secure software versions as soon as they become available from NVIDIA, alongside enforcing strict network segmentation and input validation controls to limit potential exploitation vectors.",
  "technicalDetails": "The vulnerability stems from an input validation deficiency within the NVIDIA Triton Inference Server for Linux, specifically concerning how file paths or directory references are handled during request processing. In scenarios vulnerable to path traversal, the application fails to properly sanitize or canonicalize user-supplied input containing relative path navigation sequences, such as dot-dot-slash (../) patterns, before passing them to underlying file system APIs. The root cause is the direct or insecure concatenation of untrusted input with base directory paths, allowing malicious actors to break out of the intended root directory context. The attack flow initiates when an adversary constructs a specially crafted payload designed to traverse the hierarchical directory structure of the host operating system. This payload is transmitted to the vulnerable component of the NVIDIA Triton Inference Server via the established communication channels exposed by the service. Upon receipt, the vulnerable component processes the malicious path parameter without enforcing rigorous boundary checks or utilizing secure path resolution libraries. Consequently, the file system operations are executed against unintended files or system locations. Depending on the exact nature of the file handling operations performed by the server—such as reading, writing, or opening specific configuration and model artifacts—the traversal can lead to resource locks, abnormal termination of worker threads, or segmentation faults. These anomalous behaviors collectively culminate in a denial of service state, impairing the inference server's ability to process legitimate client requests. The vulnerability affects the NVIDIA Triton Inference Server running on Linux operating systems across unspecified component versions. Depending on the deployment architecture, exploitation may not require specialized authentication or elevated administrative privileges if the vulnerable endpoint is exposed to the network or accessible via local interfaces. Network exposure significantly widens the attack surface, enabling unauthenticated remote threat actors to trigger the condition. Post-exploitation impact is primarily focused on availability disruption rather than arbitrary code execution or privilege escalation, manifesting as service outages and operational downtime for dependent machine learning workflows."
}