EUVD-2026-61111
GHSA-hpmp-93cq-96xg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local access with low privileges confirmed by description and official vector; primary confirmed impact is arbitrary file read with integrity and availability unaffected per available data.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution.
AnalysisAI
Absolute path traversal in NVIDIA Triton Inference Server for Linux exposes arbitrary filesystem files to low-privileged local attackers, with the vendor flagging potential code execution as a secondary consequence. The vulnerability is classified under CWE-36 and affects all versions captured by the wildcard CPE, meaning no upper-bound patched version is confirmed from current data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to the Linux system hosting NVIDIA Triton Inference Server with at minimum a low-privileged user account, as confirmed by the CVSS vector's AV:L and PR:L metrics. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.5 (Medium) appropriately reflects the local attack vector (AV:L) and low-privilege requirement (PR:L), which substantially narrow the exploitable population compared to network-facing vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the NVIDIA Product Security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5865 for the authoritative patch guidance; no specific patched version number is independently confirmed from available data at time of this analysis, so monitoring that advisory for an updated release is the primary recommended action. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Triton Inference Server
View allAuthentication bypass in NVIDIA Triton Inference Server allows unauthenticated remote attackers to reach protected funct
Path traversal in NVIDIA Triton Inference Server for Linux (CWE-22) lets remote attackers manipulate file paths to reach
Authentication bypass in NVIDIA Triton Inference Server allows remote unauthenticated attackers to circumvent access con
Integer overflow in the DALI backend of NVIDIA Triton Inference Server allows authenticated remote attackers to trigger
Out-of-bounds read in the DALI backend of NVIDIA Triton Inference Server allows authenticated remote attackers to trigge
NVIDIA Triton Inference Server for Linux contains a vulnerability where a user can set the logging location to an arbitr
NVIDIA Triton Inference Server for Linux contains a vulnerability in the tracing API, where a user can corrupt system fi
NVIDIA Triton Inference Server for Linux contains a vulnerability in shared memory APIs, where a user can cause an impro
Denial of service in NVIDIA Triton Inference Server for Linux allows remote unauthenticated attackers to exhaust server
Denial of service in NVIDIA Triton Inference Server for Linux (versions through 26.03) allows a remote attacker to crash
Denial of service in NVIDIA Triton Inference Server for Linux exposes AI inference infrastructure to remote disruption t
Unbounded resource allocation in NVIDIA Triton Inference Server for Linux allows remote, unauthenticated attackers to ex
Same weakness CWE-36 – Absolute Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today