What is the CVSS score of CVE-2026-24209?

CVE-2026-24209 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of NVIDIA Triton Inference Server are affected by CVE-2026-24209?

NVIDIA Triton Inference Server contains a denial-of-service vulnerability (CVE-2026-24209) exploitable without authentication, creating availability risk for AI/ML model-serving infrastructure.

How to fix or mitigate CVE-2026-24209?

Within 24 hours: Identify and inventory all NVIDIA Triton Inference Server deployments; determine which are internet-accessible or exposed to untrusted networks. Within 7 days: Implement network segmentation to restrict Triton access to trusted internal networks only; deploy request-filtering rules to block path traversal attempts (e.g., URIs containing '..' or encoded traversal sequences). Within 30 days: Monitor NVIDIA security advisories for patch release and apply immediately when available; if no patch materializes, evaluate alternative inference serving platforms (e.g., KServe, Seldon) as long-term mitigation.

NVIDIA Triton Inference Server CVE-2026-24209

EUVD-2026-31051 HIGH

Path Traversal (CWE-22)

2026-05-20 nvidia

GHSA-mf6v-qv54-r9qj

Denial Of Service Nvidia Path Traversal

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 04:01 vuln.today

DescriptionCVE.org

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successful exploit of this vulnerability might lead to denial of service.

AnalysisAI

Denial of service in NVIDIA Triton Inference Server can be triggered remotely without authentication via a path traversal flaw (CWE-22), enabling unauthenticated network attackers to disrupt model-serving availability. The CVSS 7.5 score reflects high availability impact with no confidentiality or integrity loss, and no public exploit has been identified at time of analysis.

Technical ContextAI

NVIDIA Triton Inference Server is an open-source inference-serving platform used to deploy AI/ML models (TensorFlow, PyTorch, ONNX, TensorRT, etc.) at scale via HTTP/REST and gRPC endpoints, commonly fronting GPU-backed model repositories in production ML pipelines. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - 'Path Traversal'), meaning user-controlled input referencing filesystem paths is not sufficiently sanitized, allowing references outside an intended directory. In Triton, such input typically flows through model-name, model-repository, or file-handling parameters in the inference API, where traversal sequences can be abused to reference unintended files and crash or hang the server. The single CPE entry (cpe:2.3:a:nvidia:triton_inference_server:*:*:*) confirms the product scope but does not narrow specific versions.

RemediationAI

Patch available per vendor advisory - consult NVIDIA's security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5828 for the exact fixed version and upgrade to it as the primary remediation; corroborating records are at https://nvd.nist.gov/vuln/detail/CVE-2026-24209 and https://www.cve.org/CVERecord?id=CVE-2026-24209. Until the patched build is deployed, restrict network reachability of Triton's HTTP/REST (default 8000) and gRPC (default 8001) endpoints to trusted clients via firewall or service-mesh policy (trade-off: breaks any direct external integrations), place Triton behind an authenticating reverse proxy or API gateway that strips traversal sequences such as '../' and URL-encoded variants from path/model-name parameters (trade-off: may require request-shape changes for legitimate clients), and run Triton as an unprivileged user inside a container with a read-only model repository mount to limit the blast radius of any file reference (trade-off: requires deployment changes and may affect dynamic model loading). Monitor Triton logs for repeated 4xx/5xx spikes and process restarts as early indicators of DoS probing.