NVIDIA Triton Inference Server CVE-2026-24207

The attacker requires network reachability to the Triton Inference Server's HTTP or gRPC listener (typically TCP 8000/8001/8002) and the ability to issue requests to the specific alternate path or channel that bypasses authentication. No valid credentials, user interaction, or local access are required (CVSS PR:N/UI:N/AV:N/AC:L). Realistic limiting factors not visible in the CVSS score: Triton is frequently deployed inside private VPCs or behind authenticating reverse proxies, so internet-exposed instances are the primary exploitable population; exact affected versions are not enumerated in the provided NVD data, so vulnerability presence depends on the version range defined in NVIDIA advisory 5828, and the specific alternate-channel feature involved (e.g., a particular API, endpoint, or protocol mode) is not described in the public CVE text and should be confirmed against the vendor bulletin.

All CVSS signals point to maximum severity: network-reachable (AV:N), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), with high impact across confidentiality, integrity, and availability - yielding a 9.8 base score. The vendor (NVIDIA) categorizes downstream impact as including code execution and privilege escalation, which aligns with the CIA:H ratings. However, EPSS data was not provided in the input and the CVE is not listed in CISA KEV, so widespread or opportunistic exploitation is not confirmed; the rich set of tags (RCE, DoS, Information Disclosure, Authentication Bypass) reflects vendor-described potential impact rather than observed in-the-wild activity. No public exploit identified at time of analysis. Net assessment: this should be treated as a high-priority patching item for any environment exposing Triton beyond a tightly controlled network, but exposure depends heavily on whether instances are reachable from untrusted networks - Triton is frequently deployed inside private VPCs, which is a meaningful real-world mitigating factor not captured in the CVSS score.

An attacker with network reachability to a Triton Inference Server instance - for example via an internet-exposed inference endpoint, a misconfigured Kubernetes Service, or lateral movement inside a corporate network - sends crafted requests to the alternate path that skips authentication, gaining access to protected model-management or inference APIs. From there, the attacker can load a malicious model artifact or invoke privileged operations to achieve code execution on the inference host, exfiltrate proprietary models and inference data, or disrupt service. No public exploit identified at time of analysis, but the low attack complexity makes weaponization straightforward once the alternate channel is identified.