CVE-2026-47487 is a medium severity (CVSS 4.4) path traversal in NVIDIA Triton Inference Server for Linux. A path supplied in a model name to the MLflow plugin can reach files outside the model repository. NVIDIA says to update to Triton Server r26.03 or later.
What's affected
The affected product is NVIDIA Triton Inference Server for Linux, in setups that use the Triton MLflow plugin.
NVIDIA's bulletin tells users to clone or update to Triton Server r26.03 or later from the Triton GitHub repository. The record's product list also names the Linux kernel, which looks like a platform tag, not a kernel flaw.
The NVIDIA bulletin scores it 4.4 (CVSS 3.1, Medium) with a local attack vector, low privileges required, and impacts of denial of service and information disclosure. That matches the record. NVIDIA also notes its risk assessment is an average and may not reflect your installation.
How to check if you're exposed
Find out which Triton release you run. For container deployments, check the image tag, for example:
docker ps --format '{{.Image}}' | grep -i tritonserver
NGC container tags for Triton follow a year and month pattern such as 26.03, so a tag older than 26.03 is a signal to review. Then check whether you have the MLflow plugin enabled in your deployment. If it is not used, the exposed path is not in play, though updating is still recommended.
What to do now
- Update to Triton Server r26.03 or later, as the NVIDIA bulletin instructs.
- Review who can submit model names or load models through the MLflow plugin.
- Run Triton with the least filesystem access it needs, so files outside the model repository are not readable or writable by the service account.
- Rebuild container images that pin an older Triton base.
Why it matters
The cause is CWE-22, path traversal. The plugin accepts a model name that is turned into a file path, and a crafted name can point outside the intended model repository. Depending on permissions, files can then be read, written or changed.
Inference servers often run close to model weights, credentials and data, so file access boundaries matter. The impacts NVIDIA lists are denial of service and information disclosure. The record does not mark this CVE as known exploited.
Quick check
Do I have to use MLflow to be affected?
The flaw is in the Triton MLflow plugin path handling, so deployments that do not use that plugin have less exposure. Updating is still the recommended action.
What does the Linux kernel entry in the record mean?
It appears to be a platform tag in the product listing. The vulnerability is in Triton, not the kernel.
Sources
Last reviewed: 18 October 2026.
