Database/AI/ML frameworks & serving
NVIDIA Triton Inference Server: missing authorization lets an unauthenticated caller reach protected operations
Impact
Triton fails to enforce authorization on an operation it should gate, which NVIDIA says can lead to information disclosure, data tampering and denial of service. On a shared GPU node that means a caller who can reach the port may be able to read or alter what the server is serving rather than only send inference requests - the model repository and server control surfaces are the usual concern. Note the published CVSS vector scores only availability (C:N/I:N/A:H) even though the description names disclosure and tampering, so treat the confidentiality and integrity reach as unquantified rather than ruled out. This is tracked separately from the excessive-iteration DoS in the same bulletin because the mechanism is different.
Who can reach it
Anyone who can reach the Triton HTTP/gRPC endpoint. No authentication needed. Exposure is decided by network placement: an endpoint reachable from tenant pods or a shared service network is directly at risk.
What to do
Update Triton to the fixed release in NVIDIA bulletin 2026/5875 and restart the server; the fixed version is not stated in the record here. In the meantime, put the endpoint behind an authenticating proxy or network policy so only the intended callers reach it, and do not rely on Triton's own checks to keep tenants out of server control operations.
References
Related entries
- Spring AI: predictable ONNX model cache path lets a local user plant a substitute model fileCVE-2026-47852 · Spring AI (ONNX model cache path)High
- llama.cpp: uncontrolled recursion in JSON-schema-to-grammar conversion crashes the serverCVE-2026-52130 · llama.cpp (common/json-schema-to-grammar.cpp)High
- Ollama (quantization engine): Unauthenticated remote information disclosure — reads and exfiltrates model dataCVE-2026-5757 · Ollama (quantization engine)High
- NVIDIA NemoClaw for Linux: installer downloads code without an integrity checkCVE-2026-65097 · NVIDIA NemoClaw for Linux (installation scripts)High
- Ollama (GGUF metadata parser): Uncontrolled memory allocationCVE-2026-65315 · Ollama (GGUF metadata parser)High
- Milvus: Unauthenticated DoS terminating service componentsCVE-2026-69111 · MilvusHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.