CVE-2026-24147

NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause an information disclosure by uploading a model configuration. A successful exploit of this vulnerability may lead to information disclosure or denial of service.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://nvd.nist.gov/vuln/detail/CVE-2026-24147	US Government Resource
https://nvidia.custhelp.com/app/answers/detail/a_id/5816	Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2026-24147	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nvidia:triton_inference_server:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) NVIDIA Triton Inference Server contiene una vulnerabilidad en el servidor Triton donde un atacante puede causar una revelación de información al cargar una configuración de modelo. Un exploit exitoso de esta vulnerabilidad puede llevar a la revelación de información o a la denegación de servicio.

Information

Published : 2026-04-07 18:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-24147

Mitre link : CVE-2026-24147

CVE.ORG link : CVE-2026-24147

JSON object : View

Products Affected

nvidia

triton_inference_server

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-24147", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24147", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T19:17:31.553640Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@nvidia.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}]}, "affected": [{"source": "psirt@nvidia.com", "affectedData": [{"vendor": "NVIDIA", "product": "Triton Inference Server", "versions": [{"status": "affected", "version": "All versions prior to r26.02"}], "platforms": ["All"], "defaultStatus": "unaffected"}]}], "published": "2026-04-07T18:16:39.507", "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24147", "tags": ["US Government Resource"], "source": "psirt@nvidia.com"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5816", "tags": ["Vendor Advisory"], "source": "psirt@nvidia.com"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-24147", "tags": ["Third Party Advisory"], "source": "psirt@nvidia.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@nvidia.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause an information disclosure by uploading a model configuration. A successful exploit of this vulnerability may lead to information disclosure or denial of service."}, {"lang": "es", "value": "NVIDIA Triton Inference Server contiene una vulnerabilidad en el servidor Triton donde un atacante puede causar una revelaci\u00f3n de informaci\u00f3n al cargar una configuraci\u00f3n de modelo. Un exploit exitoso de esta vulnerabilidad puede llevar a la revelaci\u00f3n de informaci\u00f3n o a la denegaci\u00f3n de servicio."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:triton_inference_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D065C964-D751-4288-96A0-0E0E87AF886A", "versionEndExcluding": "26.02"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@nvidia.com"}