EUVD-2026-52799
GHSA-r5cm-75cc-9f2g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local low-privilege access; description explicitly states write and modify capability, making I:H appropriate despite vendor-supplied I:N, no scope change applies.
Primary rating from Vendor (nvidia).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of service and information disclosure.
AnalysisAI
Path traversal in NVIDIA Triton Inference Server's MLflow plugin allows a low-privileged local user to read, write, or modify files outside the designated model repository by embedding traversal sequences in a model name parameter. All Linux deployments of Triton Inference Server through version 26.02 are affected. No active exploitation has been confirmed (not listed in CISA KEV), EPSS is 0.16% (6th percentile), and SSVC rates exploitation status as none - indicating this is a real but currently low-observed-risk vulnerability that warrants patching on a standard cadence rather than emergency response.
Technical ContextAI
NVIDIA Triton Inference Server is an open-source AI/ML inference serving platform widely used to deploy trained models in production. It supports multiple model repository backends, including an MLflow plugin that integrates with the MLflow model registry. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), colloquially 'path traversal': the MLflow plugin accepts a model name parameter and uses it to construct file system paths without adequately sanitizing directory traversal sequences (e.g., '../'). This allows the constructed path to escape the intended model repository boundary. The CPE cpe:2.3:a:nvidia:triton_inference_server:*:*:*:*:*:*:*:* covers all versions through 26.02 on Linux. The vulnerability is constrained to the MLflow plugin surface - deployments not using the MLflow backend are not exposed through this specific code path.
RemediationAI
The primary fix is to upgrade NVIDIA Triton Inference Server to a version beyond 26.02. The exact patched release version is not independently confirmed in the available data - consult the NVIDIA product security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5860 for the precise target version before deploying. If immediate patching is not feasible, administrators should apply strict Linux file system permissions to the Triton process user account, limiting its read and write access to only the model repository directory and required system paths (note: overly restrictive permissions may break legitimate plugin functionality and should be tested). Additionally, if the MLflow plugin is not actively required, disabling it eliminates the vulnerable code path entirely with no inference serving impact. Restricting which local users can submit model name inputs to the Triton API through OS-level access controls further reduces the attack surface.
More in Triton Inference Server
View allAuthentication bypass in NVIDIA Triton Inference Server allows unauthenticated remote attackers to reach protected funct
Path traversal in NVIDIA Triton Inference Server for Linux (CWE-22) lets remote attackers manipulate file paths to reach
Authentication bypass in NVIDIA Triton Inference Server allows remote unauthenticated attackers to circumvent access con
Integer overflow in the DALI backend of NVIDIA Triton Inference Server allows authenticated remote attackers to trigger
Out-of-bounds read in the DALI backend of NVIDIA Triton Inference Server allows authenticated remote attackers to trigge
NVIDIA Triton Inference Server for Linux contains a vulnerability where a user can set the logging location to an arbitr
NVIDIA Triton Inference Server for Linux contains a vulnerability in the tracing API, where a user can corrupt system fi
NVIDIA Triton Inference Server for Linux contains a vulnerability in shared memory APIs, where a user can cause an impro
Denial of service in NVIDIA Triton Inference Server for Linux allows remote unauthenticated attackers to exhaust server
Denial of service in NVIDIA Triton Inference Server for Linux (versions through 26.03) allows a remote attacker to crash
Denial of service in NVIDIA Triton Inference Server for Linux exposes AI inference infrastructure to remote disruption t
Unbounded resource allocation in NVIDIA Triton Inference Server for Linux allows remote, unauthenticated attackers to ex
Same weakness CWE-22 – Path Traversal
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today