CVE-2026-47606

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/NVIDIA/product-security/tree/main/2026/5865	Patch
https://nvd.nist.gov/vuln/detail/CVE-2026-47606	US Government Resource
https://www.cve.org/CVERecord?id=CVE-2026-47606	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:nvidia:triton_inference_server:*:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

History

22 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) NVIDIA Triton Inference Server para Linux contiene una vulnerabilidad donde un atacante podría causar un salto de ruta absoluto. Un exploit exitoso podría llevar a la ejecución de código y a la revelación de información.

Information

Published : 2026-08-18 19:16

Updated : 2026-10-22 22:10

NVD link : CVE-2026-47606

Mitre link : CVE-2026-47606

CVE.ORG link : CVE-2026-47606

JSON object : View

Products Affected

nvidia

triton_inference_server

linux

linux_kernel

CWE

CWE-36

Absolute Path Traversal

{"id": "CVE-2026-47606", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47606", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T18:42:03.730670Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@nvidia.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@nvidia.com", "affectedData": [{"vendor": "NVIDIA", "product": "Triton Inference Server", "versions": [{"status": "affected", "version": "0.0-26.05"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-08-18T19:16:50.840", "references": [{"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5865", "tags": ["Patch"], "source": "psirt@nvidia.com"}, {"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47606", "tags": ["US Government Resource"], "source": "psirt@nvidia.com"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-47606", "tags": ["Third Party Advisory"], "source": "psirt@nvidia.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@nvidia.com", "description": [{"lang": "en", "value": "CWE-36"}]}], "descriptions": [{"lang": "en", "value": "NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure."}, {"lang": "es", "value": "NVIDIA Triton Inference Server para Linux contiene una vulnerabilidad donde un atacante podr\u00eda causar un salto de ruta absoluto. Un exploit exitoso podr\u00eda llevar a la ejecuci\u00f3n de c\u00f3digo y a la revelaci\u00f3n de informaci\u00f3n."}], "lastModified": "2026-10-22T22:10:00.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:triton_inference_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED32FDDF-649D-4A1A-8402-004F0B76FF3D", "versionEndIncluding": "26.05"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@nvidia.com"}