An authentication bypass flaw exists in NVIDIA Triton Inference Server that permits an attacker to access services without valid credentials. Once authentication bypass is achieved, the attacker can execute arbitrary code on the host, elevate privileges, tamper with model data, cause denial of service, or exfiltrate sensitive information. This flaw is categorized as an Authentication Failure (CWE‑288) because the server fails to enforce required authentication policies.

NVIDIA Triton Inference Server is affected. Specific version numbers were not disclosed in the advisory, so all current releases and potentially previous ones that have not applied the patch remain vulnerable until an update is deployed.

The CVSS base score of 9.8 marks the vulnerability as critical, and the lack of an EPSS score does not reduce the inherent risk. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would likely occur over a network interface that exposes the inference service; an attacker would need to send specially crafted requests that trigger the authentication bypass logic, potentially enabling code execution. Successful exploitation could lead to full system compromise.