CVE-2026-47627: 
Triton Inference Server vulnerability analysis and mitigation

CVE-2026-47627 is a path traversal vulnerability in NVIDIA Triton Inference Server for Linux that allows an unauthenticated network attacker to cause denial of service. It affects version 0.0-26.05 of the Triton Inference Server on Linux platforms. The vulnerability was published on August 18, 2026, as part of NVIDIA Security Bulletin 5865. It carries a CVSS v3.1 base score of 9.8 (Critical), assigned by NVIDIA Corporation (NVIDIA Advisory, CVE Record).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — 'Path Traversal'), meaning the server fails to properly sanitize or restrict file path inputs provided by remote users. An unauthenticated attacker can craft malicious network requests containing path traversal sequences (e.g., ../ or URL-encoded equivalents) targeting file system operations within the Triton Inference Server, potentially accessing or manipulating files outside the intended directory. Relevant attack patterns include CAPEC-126 (Path Traversal), CAPEC-64 (Using Slashes and URL Encoding to Bypass Validation), and CAPEC-78/79 (Using Escaped or Alternate Slash Encodings). No preconditions such as authentication or user interaction are required for exploitation (NVIDIA Advisory, CVE Record).

Despite the official description focusing on denial of service, the CVSS v3.1 vector assigned by NVIDIA reflects high confidentiality, integrity, and availability impacts, suggesting the potential consequences extend beyond service disruption to include unauthorized file access and data manipulation. An unauthenticated remote attacker could crash or disable the Triton Inference Server, disrupting AI/ML inference workloads that depend on it. In environments where Triton is exposed to broader networks, exploitation could also facilitate unauthorized access to model files, configuration data, or other sensitive server-side resources (NVIDIA Advisory, CVE Record).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. However, CISA's SSVC assessment classifies the vulnerability as automatable with total technical impact, indicating that exploitation could be scripted and scaled without manual intervention (CVE Record). The EPSS score is currently 0.0, reflecting the early stage of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report.

1. Reconnaissance: Identify internet-facing or network-accessible NVIDIA Triton Inference Server instances running version 0.0-26.05 on Linux, using tools such as Shodan or Censys targeting Triton's default HTTP/gRPC ports (typically 8000, 8001, 8002).
2. Identify vulnerable endpoints: Probe the server's REST or gRPC API endpoints that accept file path parameters, such as model repository management or logging configuration endpoints.
3. Craft path traversal payload: Construct a malicious request containing path traversal sequences (e.g., ../../etc/passwd, URL-encoded variants like %2e%2e%2f, or mixed encoding) in file path parameters.
4. Send the request: Transmit the crafted request to the target server without authentication, exploiting the lack of input validation on path parameters.
5. Achieve objective: Depending on the targeted endpoint and server configuration, trigger a denial of service condition (e.g., by referencing a non-existent or restricted path that causes a crash), or attempt to read/write files outside the intended directory (NVIDIA Advisory, CVE Record).

• Network: Unusual HTTP or gRPC requests to Triton Inference Server API endpoints (ports 8000, 8001, 8002) containing path traversal sequences such as ../, %2e%2e%2f, %2e%2e/, or ..%2f in path or parameter fields; unexpected spikes in request volume from external or untrusted IP addresses.
• Logs: Triton server access logs showing requests with traversal patterns in URL paths or request bodies; error log entries indicating file-not-found or permission-denied errors for paths outside the model repository directory; server crash or restart events correlated with unusual requests.
• File System: Unexpected access attempts to files outside the Triton model repository directory (e.g., /etc/, /var/, /root/); new or modified files in sensitive directories attributable to the Triton process user.
• Process: Unexpected termination or restart of the tritonserver process; unusual child processes spawned by the Triton server process.

NVIDIA has published Security Bulletin 5865 addressing this and related CVEs in Triton Inference Server; users should apply the latest security updates provided by NVIDIA for Triton Inference Server (NVIDIA Advisory). As interim mitigations, restrict network access to the Triton server to trusted clients only using firewall rules or network segmentation, and avoid exposing the server directly to the internet. Additionally, monitor server logs for suspicious path traversal patterns and implement input validation and sanitization on all file path parameters at the application or proxy layer.

The vulnerability received coverage from The Hacker Wire, which highlighted the critical path traversal flaw and its potential for denial of service (The Hacker Wire). Social media activity on Mastodon and Bluesky noted the high CVSS score relative to the described DoS-only impact, with some community members questioning the discrepancy between the 9.8 Critical score and the limited official impact description. Automated vulnerability tracking platforms including VulDB and CVEFeed.io indexed the vulnerability shortly after publication.