NVIDIA Triton Inference Server CVE-2026-24209

Required: network reachability to the Triton Inference Server's HTTP/REST or gRPC inference API (default ports 8000 and 8001) and the ability to submit requests whose path-bearing parameters (e.g., model name or file references) are processed by the vulnerable handler. No authentication, no user interaction, and no elevated privileges are needed (CVSS PR:N/UI:N), so any client that can reach the service can attempt exploitation. Limiting factors: Triton is most often deployed inside private clusters or behind authenticated gateways, so direct internet exposure is the dominant gating condition; the vendor description does not specify whether a particular backend, model repository layout, or non-default configuration narrows the vulnerable code path, so worst case is assumed to be any reachable default-configured instance.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates a network-reachable, low-complexity, unauthenticated, no-user-interaction attack with high availability impact only - a clean DoS primitive. No EPSS score, KEV listing, or SSVC decision was provided in the input, so probability of exploitation in the wild and CISA-tracked active exploitation status cannot be confirmed; absence of those signals is not the same as low risk. There is no public exploit identified at time of analysis. Real-world priority depends heavily on exposure: Triton instances are typically deployed behind authenticated gateways or inside trusted clusters, so internet-exposed instances are the principal risk surface. The 7.5 score may overstate risk for properly segmented deployments and understate it for shops that expose Triton directly; verify exposure before prioritizing.

An attacker who can reach the Triton HTTP or gRPC inference endpoint sends a crafted request whose model-name or file-path field contains traversal sequences pointing outside the model repository, causing Triton to attempt to access an unintended path and crash or hang the worker, taking the model-serving tier offline. Repeated requests sustain the outage, disrupting any downstream application that depends on real-time inference. No public exploit has been identified at time of analysis, but the AC:L/PR:N profile means a working PoC would be straightforward to develop once specifics surface.