Compliance Impact

The provided information does not specify how the vulnerability in NVIDIA Triton Inference Server impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-24147 is a medium severity vulnerability in the NVIDIA Triton Inference Server, specifically in the triton server component. It arises from improper limitation of a pathname to a restricted directory (CWE-22), meaning the server does not properly restrict file path access when processing uploaded model configurations.

An attacker can exploit this vulnerability by uploading a specially crafted or malicious model configuration to the server. This can lead to unauthorized information disclosure or cause denial of service conditions.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can result in two main impacts: information disclosure and denial of service.

• Information disclosure: An attacker may gain access to sensitive information by exploiting the improper path limitation.
• Denial of service: The attacker may cause the Triton server to become unavailable or disrupt its normal operation.

The vulnerability has a CVSS v3.1 base score of 4.8, indicating medium severity, with low confidentiality and availability impacts, no integrity impact, and requires no privileges or user interaction but has high attack complexity.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability in the NVIDIA Triton Inference Server, users should update to Triton Inference Server version r26.02 or later.

This update addresses the vulnerability that allows an attacker to cause information disclosure or denial of service by uploading a specially crafted model configuration.

Useful 0 Not Useful 0