CVE-2026-47630: 
Triton Inference Server vulnerability analysis and mitigation

CVE-2026-47630 is an absolute path traversal vulnerability (CWE-36) in NVIDIA Triton Inference Server for Linux that may allow a local attacker to execute arbitrary code. It affects all versions of Triton Inference Server up to and including version 26.05. The vulnerability was published on August 18, 2026, and a patch was made available by September 1, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium), though Feedly categorizes its estimated impact as High (NVIDIA Product Security).

The vulnerability is classified as CWE-36 (Absolute Path Traversal), meaning the application fails to properly restrict user-supplied path inputs to a designated directory, allowing an attacker to supply absolute paths that escape intended boundaries. Exploitation mechanics involve calling dlopen with an attacker-controlled path, enabling the loading of a malicious shared library (.so file) whose constructor executes arbitrary code upon loading. The attack requires local access with low privileges and no user interaction, making it exploitable by any unprivileged local user on an affected Linux system running Triton Inference Server (NVIDIA Product Security, PoC GitHub).

Successful exploitation allows a local low-privileged attacker to read sensitive files on the system (high confidentiality impact) and potentially execute arbitrary code in the context of the Triton Inference Server process. Integrity and availability impacts are rated as none per the CVSS scoring, but code execution via a malicious shared library constructor could enable privilege escalation or lateral movement within the host environment. The scope is limited to the local system, but in AI/ML infrastructure environments where Triton is deployed, unauthorized access to model data, inference pipelines, or host credentials could have significant downstream consequences (NVIDIA Product Security).

A public proof-of-concept exploit is available on GitHub at https://github.com/s1ko/CVE-2026-47630, published on August 24, 2026. The PoC consists of standalone C code in a poc/ directory, including build.sh, test_dlopen.c, and an evil.so payload whose constructor fires upon loading and logs the process PID, UID, EUID, and current working directory — demonstrating arbitrary code execution. No in-the-wild exploitation has been observed as of the time of this report, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.14%, reflecting low but non-zero exploitation probability (PoC GitHub).

1. Reconnaissance: Identify a Linux system running NVIDIA Triton Inference Server version 26.05 or earlier with local access available to a low-privileged user.
2. Prepare malicious shared library: Compile a malicious .so file (e.g., evil.so) containing a constructor function that executes the desired payload — such as logging credentials, spawning a reverse shell, or writing a file to confirm execution.
3. Place payload: Copy the compiled evil.so to an attacker-controlled absolute path on the local filesystem accessible to the Triton process.
4. Trigger path traversal: Invoke the vulnerable Triton functionality that calls dlopen with a user-supplied path, providing the absolute path to evil.so instead of a relative or sandboxed path.
5. Achieve code execution: The dlopen call loads evil.so, firing its constructor and executing the attacker's payload in the context of the Triton Inference Server process, potentially with elevated privileges (PoC GitHub).

• File System: Presence of unexpected .so files in world-writable or user-controlled directories; new files created by the Triton process (e.g., log files recording pid/uid/euid/cwd as described in the PoC).
• Process: Unusual child processes or library loads spawned by the Triton Inference Server process; dlopen calls referencing absolute paths outside expected model/plugin directories visible in process tracing (e.g., strace, auditd).
• Logs: Linux audit log (auditd) entries showing openat or dlopen syscalls with unexpected absolute paths by the Triton process; unexpected file creation events in /tmp or user home directories attributed to the Triton service account.
• Network: Unexpected outbound connections from the Triton Inference Server process to external IPs, which may indicate a reverse shell payload was executed post-exploitation (PoC GitHub).

NVIDIA has released a patch addressing this vulnerability, documented in Security Bulletin 5865 (August 2026). Users should upgrade NVIDIA Triton Inference Server to a version beyond 26.05 as directed by the bulletin. As interim mitigations, restrict local access to systems running Triton Inference Server to trusted users only, implement filesystem access controls to prevent untrusted users from placing files in paths accessible to the Triton process, and enable auditd monitoring for unexpected dlopen activity. Network segmentation can further reduce the attack surface by limiting who can reach systems hosting the service (NVIDIA Product Security).

The vulnerability received routine coverage across CVE tracking platforms including VulDB, CVEFeed, and CIRCL shortly after disclosure on August 18, 2026. A social media post on Infosec.exchange and a Bluesky notification were among the earliest community reactions. Hawk-Eye's weekly threat landscape digest for Week 34 of 2026 included the vulnerability in its roundup. No notable vendor statements beyond the NVIDIA security bulletin or significant researcher commentary beyond the PoC publication have been identified (NVIDIA Product Security, PoC GitHub).