Triton Inference Server CVE-2026-24215

The attacker must hold a low-privileged account on the Triton Inference Server (PR:L from CVSS vector - unauthenticated exploitation is not indicated). The DALI backend must be enabled and accessible to the attacker's account. User interaction is required (UI:R from CVSS vector), meaning exploitation cannot be fully automated without some action from an authorized user or the attacker acting in their own low-privileged context. Exploitation is limited to availability impact only - no confidentiality or integrity compromise is possible per the CVSS vector (C:N/I:N). The scope is unchanged (S:U), meaning the vulnerability cannot be used to pivot beyond the Triton server process. Deployments where the DALI backend is disabled or where inference API access is restricted to fully trusted internal accounts are not meaningfully exposed.

The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) characterizes this as a medium-severity, network-exploitable denial-of-service affecting availability only. The PR:L requirement means an attacker must hold at least a low-privileged account on the Triton instance, reducing the exposed attack surface compared to unauthenticated vulnerabilities. The UI:R flag is atypical for a pure server-side DoS and may indicate an administrator or authorized user must trigger a specific action (e.g., loading a model pipeline or submitting a particular inference request type) for exploitation to succeed. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit code identified, suggesting this has not been observed in active campaigns. The overall real-world risk is moderate: deployments exposing Triton's inference endpoints to untrusted authenticated users (e.g., shared multi-tenant inference infrastructure) face the highest practical risk, while air-gapped or single-tenant deployments are significantly less exposed.

An attacker with a low-privileged account on a shared Triton Inference Server instance crafts a malicious DALI pipeline or inference request designed to consume disproportionate server resources (CPU, memory, or threads). After an authorized user or the attacker themselves triggers execution of the malicious pipeline - satisfying the UI:R condition - the DALI backend processes the request without enforcing resource limits, causing the server process to degrade or become unresponsive, denying service to other legitimate inference clients. No public exploit code has been identified at time of analysis.