What is the CVSS score of CVE-2026-24207?

CVE-2026-24207 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of NVIDIA Triton Inference Server are affected by CVE-2026-24207?

NVIDIA Triton Inference Server contains a critical unauthenticated remote authentication bypass (CVE-2026-24207, CVSS 9.8) that allows attackers to access protected functionality and potentially…

Is there a public PoC exploit available for CVE-2026-24207?

Yes, a public proof-of-concept exploit is available for CVE-2026-24207. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-24207?

Within 24 hours: conduct inventory of all NVIDIA Triton deployments, determine which are network-accessible, and identify installed versions. Within 7 days: implement compensating controls (network segmentation, firewall rules restricting access to trusted networks only, disable public exposure). Within 30 days: monitor NVIDIA security advisories for patch release, test patch in isolated environment, and prepare expedited deployment procedure.

NVIDIA Triton Inference Server CVE-2026-24207

EUVD-2026-31047 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-05-20 nvidia

GHSA-gfjf-7c33-r54h

Information Disclosure Authentication Bypass RCE Denial Of Service Nvidia Triton Inference Server

9.8

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (nvidia) · only source for this CVE.

CVSS VectorVendor: nvidia

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 04:00 vuln.today

DescriptionCVE.org

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure.

Articles & Coverage 1

POC CVE-2026-24207: NVIDIA Triton Inference Server Auth Bypass Enables Pre-Auth RCE on SageMaker (CVSS 9.8) Jun 26, 2026

AnalysisAI

Authentication bypass in NVIDIA Triton Inference Server allows unauthenticated remote attackers to reach protected functionality over the network, potentially chaining to code execution, privilege escalation, data tampering, denial of service, or information disclosure. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) reflects a critical severity issue affecting an AI/ML inference platform commonly deployed in production model-serving environments. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.

Technical ContextAI

NVIDIA Triton Inference Server is an open-source inference-serving platform that hosts machine-learning models (TensorFlow, PyTorch, ONNX, TensorRT, etc.) and exposes them via HTTP/REST and gRPC endpoints, typically deployed in GPU-backed production environments. The root cause maps to CWE-288 (Authentication Bypass Using an Alternate Path or Channel), meaning the server enforces authentication on the primary code path but exposes an alternate route, endpoint, or interface that does not apply the same checks. Because Triton's network-facing surface includes model management, inference, and metrics APIs, an alternate-channel bypass can directly expose sensitive control-plane functionality. The affected CPE is cpe:2.3:a:nvidia:triton_inference_server with version data marked as wildcard in NVD, indicating exact affected ranges must be obtained from NVIDIA's advisory.

RemediationAI

Consult the NVIDIA security advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5828 and upgrade Triton Inference Server to the fixed release listed there; exact fix version is not enumerated in the provided NVD data so the vendor bulletin is authoritative. As compensating controls until patching is complete, restrict network exposure of the Triton HTTP (default 8000) and gRPC (default 8001) endpoints to trusted clients via firewall rules, security groups, or service mesh policies - accepting the trade-off that legitimate remote inference clients must be allow-listed; place Triton behind an authenticating reverse proxy (e.g., NGINX, Envoy, or a cloud API gateway enforcing mTLS or OIDC) so the alternate-channel bypass cannot be reached directly, noting added latency and operational complexity; and disable or block the model-control endpoints (model load/unload APIs) if not required for runtime operations, recognizing this prevents dynamic model updates. Monitor inference and management endpoints for anomalous requests from unexpected sources.