Description
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to escalation of privileges, denial of service, or information disclosure.
Published: 2026-05-20
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

NVIDIA Triton Inference Server allows an attacker to bypass authentication controls, which can lead to unauthorized privilege escalation, disruption of service, or exposure of sensitive data. The weakness aligns with CWE-288, describing an authentication failure that permits unauthorized access. No additional exploitation conditions are documented beyond the bypass.

Affected Systems

The affected vendor is NVIDIA and the product is the Triton Inference Server. Specific impacted versions are not listed in the advisory.

Risk and Exploitability

The CVSS score of 7.3 classifies this vulnerability as high severity, indicating significant impact if exploited. Because no EPSS score is available, the current exploitation probability cannot be quantified, and the vulnerability is not listed in CISA's KEV catalog, suggesting limited or no known active exploitation. Based on the description, the likely attack vector is across network interfaces where the server’s authentication mechanism can be accessed, allowing an attacker to reach the server’s administrative or inference endpoints without valid credentials. The absence of detailed exploitation steps implies that operational or configuration weaknesses would enable the bypass.

Generated by OpenCVE AI on May 20, 2026 at 04:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest vendor patch or upgrade Triton Inference Server to a version containing the fix for the authentication bypass.
  • Configure the server to enforce strong, mandatory authentication, such as requiring TLS, mutual authentication, or OAuth tokens, and validate credentials strictly.
  • Restrict administrative and inference endpoints to trusted networks, apply network segmentation, and monitor for unauthorized access attempts to mitigate potential exploitation.

Generated by OpenCVE AI on May 20, 2026 at 04:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 20 May 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:a:nvidia:triton_inference_server:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel

Wed, 20 May 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Wed, 20 May 2026 05:15:00 +0000

Type Values Removed Values Added
Title Authentication Bypass Enabling Privilege Escalation, DoS, or Information Disclosure in NVIDIA Triton Inference Server

Wed, 20 May 2026 04:45:00 +0000

Type Values Removed Values Added
First Time appeared Nvidia
Nvidia triton Inference Server
Vendors & Products Nvidia
Nvidia triton Inference Server

Wed, 20 May 2026 03:30:00 +0000

Type Values Removed Values Added
Description NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to escalation of privileges, denial of service, or information disclosure.
Weaknesses CWE-288
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}


Subscriptions

Linux Linux Kernel
Nvidia Triton Inference Server
cve-icon MITRE

Status: PUBLISHED

Assigner: nvidia

Published:

Updated: 2026-05-20T12:38:35.780Z

Reserved: 2026-01-21T19:09:34.871Z

Link: CVE-2026-24206

cve-icon Vulnrichment

Updated: 2026-05-20T12:38:31.376Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-20T04:16:45.713

Modified: 2026-05-20T17:31:24.760

Link: CVE-2026-24206

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-20T05:00:17Z

Weaknesses