CVE-2026-24147 Path traversal in Triton Inference Server
An attacker can cause information disclosure or denial of service by uploading a malicious model configuration to NVIDIA Triton Inference Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-24147?
CVE-2026-24147 is a medium-severity path traversal vulnerability in Nvidia Triton Inference Server, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause an information disclosure by uploading a model configuration. A successful exploit of this vulnerability may lead to information disclosure or denial of service.
Weakness: CWE-22
Which versions are affected by CVE-2026-24147?
It affects 1 product.
Products include Nvidia Triton Inference Server.
How do I fix CVE-2026-24147?
No fix has been published for CVE-2026-24147 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-24147 being exploited?
There is no known exploitation of CVE-2026-24147 in the wild and no public exploit code.
Other vulnerabilities in Nvidia Triton Inference Server
Sources
Also known as GHSA-j364-q6wp-mwj2.