GPU VulnDB

Database/AI/ML frameworks & serving

NVIDIA Triton Inference Server: missing authorization lets an unauthenticated caller reach protected operations

CVSS 7.5CVE-2026-47625AI/ML frameworks & servingcurated

Impact

Triton fails to enforce authorization on an operation it should gate, which NVIDIA says can lead to information disclosure, data tampering and denial of service. On a shared GPU node that means a caller who can reach the port may be able to read or alter what the server is serving rather than only send inference requests - the model repository and server control surfaces are the usual concern. Note the published CVSS vector scores only availability (C:N/I:N/A:H) even though the description names disclosure and tampering, so treat the confidentiality and integrity reach as unquantified rather than ruled out. This is tracked separately from the excessive-iteration DoS in the same bulletin because the mechanism is different.

Who can reach it

Anyone who can reach the Triton HTTP/gRPC endpoint. No authentication needed. Exposure is decided by network placement: an endpoint reachable from tenant pods or a shared service network is directly at risk.

What to do

Update Triton to the fixed release in NVIDIA bulletin 2026/5875 and restart the server; the fixed version is not stated in the record here. In the meantime, put the endpoint behind an authenticating proxy or network policy so only the intended callers reach it, and do not rely on Triton's own checks to keep tenants out of server control operations.

References

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.