External risk intelligence

NVIDIA Triton Inference Server Path Traversal Leading to Denial of Service

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-47627

NVIDIA Triton Inference Server is typically deployed as a model serving backend, frequently exposed via HTTP/gRPC APIs to provide inference services to web applications or external clients, making its network-facing interface a common deployment pattern.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in NVIDIA's Triton Inference Server, affecting Linux systems. This flaw could allow an unauthorized individual to access or manipulate server functions, potentially leading to a disruption of service. The primary concern is confirming whether our environment utilizes this specific technology and if it is exposed in a way that could be targeted.

Path traversal flaw affects NVIDIA AI server.
Critical flaw allows unauthorized access, service disruption.
Confirm relevance and exposure of AI model serving.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the NVIDIA Triton Inference Server over the network. This request would attempt to leverage a path traversal flaw within the server's processing of requests. If successful, this could allow the attacker to manipulate file paths, potentially leading to a denial of service by disrupting the server's operation.

No authentication required.
Path traversal in request handling.
Leads to denial of service.

Live Threat

Current exploitation, exposure, and threat context

The NVIDIA Triton Inference Server for Linux could be affected by a path traversal vulnerability. When supported by the advisory, an attacker could potentially trigger a denial of service by exploiting this weakness. No specific system data, user data, or sensitive information is indicated as being at risk beyond service availability.

Service availability may be impacted.
Path traversal could occur remotely.
Denial of service is a realistic consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

The NVIDIA Triton Inference Server's path traversal vulnerability necessitates immediate attention from teams responsible for AI/ML infrastructure and security operations. The first critical step involves identifying all instances of the affected server, assessing their network exposure and business criticality, and locating the designated owner for remediation. This allows for a prioritized response and informed decision-making regarding patching or implementing temporary mitigations.

AI/ML platform and infrastructure teams own remediation.
Verify server reachability and criticality.
Plan and schedule urgent maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the NVIDIA Triton Inference Server?

NVIDIA Triton Inference Server is a specialized software platform designed to manage and deploy machine learning models at scale. It allows organizations to run AI models on Linux systems, providing a standard interface for applications to send data—such as images or text—to these models and receive predictions back, often serving as the backend engine for AI-powered services.

What does path traversal mean in CVE-2026-47627?

This vulnerability is classified as CWE-22, known as Improper Limitation of a Pathname to a Restricted Directory. In plain English, it means the server fails to properly sanitize input, allowing an attacker to use special characters to 'traverse' outside of the intended folders. By tricking the server into accessing unauthorized file paths, an attacker can interfere with its operations, leading to a denial of service.

How does an attacker trigger this vulnerability?

An attacker triggers this bug by sending a specially crafted request to the server over the network. Because the vulnerability does not require any authentication, the server accepts these requests without verifying the sender's identity. Simply accessing the server's standard legitimate functions does not trigger the bug; the request must specifically contain malicious path-manipulation input designed to disrupt the server's processing.

Is my server at risk according to Halo Surface Signal?

Halo Surface Signal indicates that Triton Inference Server is frequently deployed as a network-facing backend for web applications or external clients. Because it often uses HTTP or gRPC APIs to provide inference services, these interfaces are common targets. If your deployment allows external clients to communicate directly with the server, your risk is elevated because the vulnerability is reachable over the network.

What should I do if I run this software?

Your first step is to locate and inventory all instances of Triton Inference Server within your environment. Once identified, work with your AI and infrastructure teams to verify if those instances are reachable from the network. Assessing the business impact of these servers will help you prioritize them for urgent maintenance, such as patching or applying security mitigations provided by NVIDIA.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.