What is the CVSS score of CVE-2026-24206?

CVE-2026-24206 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of NVIDIA Triton Inference Server are affected by CVE-2026-24206?

NVIDIA Triton Inference Server contains an unauthenticated remote authentication bypass (CVE-2026-24206) that allows attackers to circumvent access controls without credentials, risking unauthorized…

How to fix or mitigate CVE-2026-24206?

Within 24 hours: Inventory all NVIDIA Triton Inference Server instances, document versions in use, and assess network exposure. Within 7 days: Restrict network access via firewall (deny direct internet routes), place Triton behind an authentication gateway (API key or OAuth), and enable detailed access logging. Within 30 days: Monitor NVIDIA security advisories (https://nvidia.custhelp.com) for patch release; apply patches immediately upon availability; if patching delays exceed 30 days, evaluate alternative inference serving platforms or mandate network-only deployment (air-gapped/VPN-protected access).

NVIDIA Triton Inference Server CVE-2026-24206

EUVD-2026-31049 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-05-20 nvidia

GHSA-8pxv-chrc-9c6j

Information Disclosure Nvidia Denial Of Service Authentication Bypass

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 04:01 vuln.today

DescriptionCVE.org

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to escalation of privileges, denial of service, or information disclosure.

AnalysisAI

Authentication bypass in NVIDIA Triton Inference Server allows remote unauthenticated attackers to circumvent access controls, potentially leading to privilege escalation, denial of service, or information disclosure. With a CVSS 7.3 score and network-reachable attack vector (AV:N/AC:L/PR:N/UI:N), the flaw is exploitable without user interaction or credentials, though no public exploit identified at time of analysis. The vulnerability is not currently listed in CISA KEV, and EPSS data was not provided in the source intelligence.

Technical ContextAI

NVIDIA Triton Inference Server is an open-source serving framework used to deploy AI/ML models at scale across GPU and CPU infrastructure, supporting frameworks such as TensorFlow, PyTorch, ONNX, and TensorRT. It exposes HTTP/REST and gRPC endpoints for inference, model management, and metrics, frequently deployed in MLOps pipelines and production AI serving stacks. The root cause is CWE-288 (Authentication Bypass Using an Alternate Path or Channel), meaning an attacker can reach protected functionality through a route that fails to enforce the intended authentication check, bypassing the access control layer entirely rather than defeating credentials.

RemediationAI

Consult the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5828 to identify the fixed Triton Inference Server release and upgrade to that version - exact fixed version is not stated in the provided intelligence, so do not assume a specific tag. As compensating controls until patched, place Triton behind an authenticating reverse proxy (e.g., an ingress enforcing mTLS or OAuth) so the bypassable path is unreachable directly, restrict the HTTP (default 8000), gRPC (8001), and metrics (8002) ports to allow-listed client subnets via host or cloud firewall, and disable the model-control and repository management endpoints by running with --model-control-mode=none if the deployment does not require dynamic model loading (trade-off: prevents hot-loading new models without a restart). For multi-tenant or shared environments, isolate each Triton instance per tenant rather than relying on application-layer auth.