CVE-2026-47487: Triton Inference Server path

CISO Take

NVIDIA's Triton Inference Server ships an MLflow plugin that fails to sanitize the model name field, so a local user can embed directory-traversal sequences to read, write, or modify files outside the designated model repository. This is a local-only, low-complexity flaw (CVSS 4.4, AV:L/PR:L) rather than a remote pre-auth exploit, and its EPSS score sits at just 0.18% with a CISA SSVC decision of TRACK — the lowest urgency tier — meaning near-term mass exploitation is unlikely and there is no public PoC, Nuclei template, or KEV listing. The real exposure is in shared or multi-tenant model-serving environments where several teams or pipelines share a Triton host: a low-privileged local account (a CI job, a notebook user, a compromised sidecar container) could exfiltrate credentials or corrupt another team's model artifacts, producing information disclosure or denial of service. Track this via the vendor advisory (NVIDIA product-security GitHub, entry 2026/5860) and patch when a fixed build is available; in the interim, disable or tightly restrict the MLflow plugin, validate/allow-list model names, and enforce filesystem permissions so Triton's process cannot traverse outside its model repository.

Sources: NVD EPSS NVIDIA product-security advisory

What is the risk?

Medium severity (CVSS 4.4) with local attack vector and low privileges required — this is not remotely exploitable and needs an existing local foothold on the Triton host. Confidentiality and availability impact are both low, integrity is unaffected per the vector string, though the description also mentions possible file modification. EPSS (0.18%) and CISA SSVC (TRACK) both indicate low near-term exploitation pressure, and there is no evidence of a public exploit or scanner coverage. Overall risk is limited but non-trivial in shared/multi-tenant ML infrastructure where local access boundaries between teams or workloads are weak.

How does the attack unfold?

Local access

Adversary already holds a low-privileged local account or process on the host running Triton Inference Server (e.g., shared notebook, CI job, compromised container).

Path traversal exploitation

Adversary submits a model-load request via the MLflow plugin with a crafted model name containing directory traversal sequences, causing Triton to resolve paths outside the model repository.

AML.T0037

Impact

Resulting file read/write outside the repository leads to information disclosure of sensitive host files or corruption of other models/data, potentially degrading or crashing the inference service.

Local access

Adversary already holds a low-privileged local account or process on the host running Triton Inference Server (e.g., shared notebook, CI job, compromised container).

Path traversal exploitation

Adversary submits a model-load request via the MLflow plugin with a crafted model name containing directory traversal sequences, causing Triton to resolve paths outside the model repository.

AML.T0037

Impact

Resulting file read/write outside the repository leads to information disclosure of sensitive host files or corruption of other models/data, potentially degrading or crashing the inference service.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Triton Inference Server	—	—	No patch

Do you use Triton Inference Server? You're affected.

How severe is it?

CVSS 3.1

4.4 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 8% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C Low

I None

A Low

What should I do?

1 step

1) Apply the NVIDIA-provided fix once released — track the advisory at github.com/NVIDIA/product-security/tree/main/2026/5860. 2) Until patched, disable the Triton MLflow plugin if not strictly required, or restrict which accounts can invoke model-load operations through it. 3) Validate/allow-list model name inputs at any orchestration layer in front of Triton to reject path-traversal sequences (../, absolute paths). 4) Run the Triton process under a low-privilege account with filesystem permissions scoped strictly to the model repository directory, denying access to sensitive host paths. 5) Monitor Triton logs and file-integrity tooling for unexpected reads/writes outside the model repo path as a detection signal.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage DoS Inference Plugin AML.T0037 - Data from Local System

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 / A.8 - Security of AI system infrastructure

NIST AI RMF

MANAGE-4.1 - Risk treatment of deployed AI system vulnerabilities

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-47487?

NVIDIA's Triton Inference Server ships an MLflow plugin that fails to sanitize the model name field, so a local user can embed directory-traversal sequences to read, write, or modify files outside the designated model repository. This is a local-only, low-complexity flaw (CVSS 4.4, AV:L/PR:L) rather than a remote pre-auth exploit, and its EPSS score sits at just 0.18% with a CISA SSVC decision of TRACK — the lowest urgency tier — meaning near-term mass exploitation is unlikely and there is no public PoC, Nuclei template, or KEV listing. The real exposure is in shared or multi-tenant model-serving environments where several teams or pipelines share a Triton host: a low-privileged local account (a CI job, a notebook user, a compromised sidecar container) could exfiltrate credentials or corrupt another team's model artifacts, producing information disclosure or denial of service. Track this via the vendor advisory (NVIDIA product-security GitHub, entry 2026/5860) and patch when a fixed build is available; in the interim, disable or tightly restrict the MLflow plugin, validate/allow-list model names, and enforce filesystem permissions so Triton's process cannot traverse outside its model repository.

Is CVE-2026-47487 actively exploited?

No confirmed active exploitation of CVE-2026-47487 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47487?

1) Apply the NVIDIA-provided fix once released — track the advisory at github.com/NVIDIA/product-security/tree/main/2026/5860. 2) Until patched, disable the Triton MLflow plugin if not strictly required, or restrict which accounts can invoke model-load operations through it. 3) Validate/allow-list model name inputs at any orchestration layer in front of Triton to reject path-traversal sequences (../, absolute paths). 4) Run the Triton process under a low-privilege account with filesystem permissions scoped strictly to the model repository directory, denying access to sensitive host paths. 5) Monitor Triton logs and file-integrity tooling for unexpected reads/writes outside the model repo path as a detection signal.

What systems are affected by CVE-2026-47487?

This vulnerability affects the following AI/ML architecture patterns: model serving, ml ops pipelines.

What is the CVSS score for CVE-2026-47487?

CVE-2026-47487 has a CVSS v3.1 base score of 4.4 (MEDIUM). The EPSS exploitation probability is 0.18%.

What is the AI security impact?

Affected AI Architectures

model servingml ops pipelines

MITRE ATLAS Techniques

AML.T0037 Data from Local System

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6 / A.8

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of service and information disclosure.

Exploitation Scenario

A low-privileged local user — e.g., a shared notebook account, a CI/CD job, or a compromised sidecar container on a multi-tenant ML host — issues a model-load request through the Triton MLflow plugin with a crafted model name containing directory traversal sequences (such as '../../etc/somefile' or similar). Triton resolves the path relative to its model repository without sufficient sanitization, allowing the request to read a sensitive configuration file (information disclosure) or overwrite a file belonging to another team's pipeline (integrity/availability impact), disrupting that team's inference service.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.