EUVD-2026-72938
GHSA-rgfx-6m32-rxw5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vendor description explicitly names information disclosure and data tampering alongside DoS, warranting C:L and I:L despite vendor CVSS showing C:N/I:N.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
3DescriptionCVE.org
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.
AnalysisAI
Missing authorization (CWE-862) in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to reach protected API endpoints without authorization checks. Per NVIDIA's own description, successful exploitation can lead to information disclosure, data tampering, and denial of service - though the vendor's CVSS vector scores only A:H (Availability: High), creating a notable discrepancy with the stated impact breadth. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special configuration is required for the denial-of-service impact path - unauthenticated remote exploitation is possible against default Triton Inference Server deployments that expose their HTTP or gRPC ports to the network, consistent with the AV:N/AC:L/PR:N/UI:N CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this at 7.5, reflecting a straightforward unauthenticated network-exploitable DoS with no authentication or user interaction required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the NVIDIA Product Security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5875 for the specific patched release version - no exact fix version was present in the available intelligence at time of analysis, so the patch status is 'patch available per vendor advisory' without an independently confirmed fixed version number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all NVIDIA Triton deployments in your environment and assess which instances are reachable from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Triton Inference Server
View allAuthentication bypass in NVIDIA Triton Inference Server allows unauthenticated remote attackers to reach protected funct
Path traversal in NVIDIA Triton Inference Server for Linux (CWE-22) lets remote attackers manipulate file paths to reach
Authentication bypass in NVIDIA Triton Inference Server allows remote unauthenticated attackers to circumvent access con
Integer overflow in the DALI backend of NVIDIA Triton Inference Server allows authenticated remote attackers to trigger
Out-of-bounds read in the DALI backend of NVIDIA Triton Inference Server allows authenticated remote attackers to trigge
NVIDIA Triton Inference Server for Linux contains a vulnerability where a user can set the logging location to an arbitr
NVIDIA Triton Inference Server for Linux contains a vulnerability in the tracing API, where a user can corrupt system fi
NVIDIA Triton Inference Server for Linux contains a vulnerability in shared memory APIs, where a user can cause an impro
Denial of service in NVIDIA Triton Inference Server for Linux allows remote unauthenticated attackers to exhaust server
Denial of service in NVIDIA Triton Inference Server for Linux (versions through 26.03) allows a remote attacker to crash
Denial of service in NVIDIA Triton Inference Server for Linux exposes AI inference infrastructure to remote disruption t
Unbounded resource allocation in NVIDIA Triton Inference Server for Linux allows remote, unauthenticated attackers to ex
Same weakness CWE-862 – Missing Authorization
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today