NVIDIA Triton Inference Server CVE-2026-24206

No special conditions - remote unauthenticated exploitation against default configurations of NVIDIA Triton Inference Server is possible per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Limiting factors are network reachability to the Triton HTTP (8000), gRPC (8001), or metrics (8002) listener - Triton is typically deployed inside private subnets or Kubernetes clusters rather than directly internet-exposed, so practical exploitability hinges on whether the targeted instance is reachable from an attacker-controlled position (co-tenant, internal user, exposed cloud endpoint, or chained from another foothold). Impact is bounded to low confidentiality, integrity, and availability per the CVSS vector, indicating partial rather than total compromise of the service.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) describes a network-reachable, low-complexity attack requiring no privileges and no user interaction, yielding low impact across confidentiality, integrity, and availability - producing a base score of 7.3 (High). Although no public exploit has been identified at time of analysis and the CVE is not in CISA KEV, the unauthenticated network-exploitable profile makes Triton instances exposed beyond a trusted perimeter (cloud-hosted inference endpoints, dev/test rigs reachable from corporate networks) priority targets. EPSS probability was not included in the provided intelligence, so widespread exploitation likelihood cannot be quantified; defenders should treat this as a high-priority patch for any internet-facing or multi-tenant Triton deployment but a moderate priority for internal, network-segmented services. The description is generic about which authentication path is bypassed - the vendor advisory at nvidia.custhelp.com (answer 5828) should be consulted to confirm whether HTTP, gRPC, or a management endpoint is the affected surface.

An attacker on the same network as a Triton Inference Server (for example a co-tenant in a cloud VPC, an internal user, or anyone reaching an internet-exposed inference endpoint) sends a crafted HTTP or gRPC request to a route that fails to enforce authentication, gaining access to protected model management, inference, or metrics functionality. Depending on which endpoint is bypassed, the attacker could enumerate or pull deployed model artifacts (information disclosure), unload or replace models (denial of service), or invoke privileged management actions (privilege escalation). No public exploit is identified at time of analysis, but the low attack complexity and lack of required privileges make weaponization straightforward once the bypassable path is identified from the vendor advisory.