Triton Inference Server CVE-2026-47630

Exploitation requires local access to the Linux system hosting NVIDIA Triton Inference Server with at minimum a low-privileged user account, as confirmed by the CVSS vector's AV:L and PR:L metrics. The attacker must additionally be able to submit requests to the Triton server process - through its local API, socket interface, or model-management endpoint - with the ability to supply attacker-controlled path strings. No non-default configuration is indicated as a prerequisite; the flaw appears to reside in baseline Triton path-handling logic. Exploitation is bounded by the following limiting factors: (1) local system access is mandatory - remote unauthenticated network attackers cannot exploit this directly per AV:L; (2) a local account with at least low privileges is required per PR:L; (3) UI:N means no privileged user action is needed, making the exploit self-sufficient once local access is obtained. Any code execution impact beyond file read has not been confirmed by CVSS metrics and may require additional conditions not yet disclosed.

The CVSS 3.1 base score of 5.5 (Medium) appropriately reflects the local attack vector (AV:L) and low-privilege requirement (PR:L), which substantially narrow the exploitable population compared to network-facing vulnerabilities. However, the high confidentiality impact (C:H) is contextually serious for Triton deployments: inference servers commonly have filesystem adjacency to model weights, training datasets, inference API keys, and internal configuration secrets. Even a mid-sized AI platform team in malbork running Triton in a shared GPU cluster environment should treat this as meaningful risk if the server process has broad filesystem access and multiple users hold local accounts. The 'RCE' tag included by the reporter conflicts materially with the CVSS impact metrics (C:H/I:N/A:N) - genuine code execution would warrant I:H and A:H, not zeroed-out integrity and availability; this discrepancy is not resolved in available data and should be verified directly with NVIDIA. No EPSS probability is available for comparison, and the absence of a KEV listing and POC code support a current SSVC disposition of 'Track' with escalation to 'Attend' for multi-tenant or shared-GPU deployments.

A low-privileged local user on a Linux host running Triton Inference Server submits a model-loading or inference API request that contains an absolute filesystem path such as '/etc/ssh/ssh_host_rsa_key' or '/root/.aws/credentials' as a configuration or model path parameter. The server processes the path without stripping or validating the absolute reference, reads the targeted file, and returns or exposes its contents to the attacker. If a code execution pathway exists as suggested by the vendor's RCE tag, the attacker may additionally target writable script or configuration locations that are subsequently executed by the server process.