CVE-2026-24209

Vulnerability

Overview

NVIDIA Triton Inference Server contains a path traversal vulnerability in versions prior to 26.05. This flaw arises from improper sanitization of user-supplied input used in file path operations, allowing an attacker to access files outside the intended directory structure [1].

Attack

Vector

An unauthenticated attacker with network access to the Triton Inference Server's management API can send specially crafted requests containing path traversal sequences (e.g., ../). No prior authentication is required to reach the vulnerable endpoint, making the attack surface accessible from the network [1].

Impact

Successful exploitation could allow the attacker to read or manipulate files outside the server's intended restricted scope, leading to a denial of service condition. The vulnerability is rated High with a CVSS v3 base score of 7.5, indicating significant potential impact on system availability [1].

Mitigation

NVIDIA has released updated versions of Triton Inference Server that fix the path traversal issue. Users should upgrade to version 26.05 or later to remediate the vulnerability. No known workarounds are available [1].