CVE-2026-47606 is an absolute path traversal in NVIDIA Triton Inference Server for Linux, scored CVSS 6.5 (medium) in the NVD record. NVIDIA says a successful exploit might lead to code execution and information disclosure. NVIDIA's August 2026 bulletin 5865 covers it, so check your version against that.
What's affected
The NVD record names NVIDIA Triton Inference Server for Linux as the affected product. It gives no version numbers.
NVIDIA's product security repository lists a bulletin titled Security Bulletin: NVIDIA Triton Inference Server, August 2026, number 5865. That page names five CVEs: CVE-2026-47606, CVE-2026-47627, CVE-2026-47628, CVE-2026-47629 and CVE-2026-47630. The directory listing I could fetch did not show the affected or fixed releases, so I will not state them. Open the bulletin text for those.
The record's vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, so it is network reachable without privileges. The score of 6.5 reflects limited confidentiality and integrity impact in that rating.
How to check if you're exposed
- Find the Triton release you run. For containers from NVIDIA's registry the tag usually carries the release, for example
docker images | grep tritonserver. - For a running container,
docker inspect --format '{{.Config.Image}}' <container>shows the image reference. - For a source or package install, run the server's version output, for example
tritonserver --versionwhere your build supports it. - Compare with the affected and fixed releases in NVIDIA's bulletin 5865.
Also review who can reach the server's HTTP and gRPC ports and which model repository paths it can read, since this weakness class involves file paths.
What to do now
- Open NVIDIA's bulletin 5865 and note the fixed Triton release.
- Inventory every Triton deployment, including notebooks, staging and edge hosts.
- Upgrade to the fixed release and redeploy.
- Limit network access to the inference ports to the clients that need them.
- Review the model repository location and the filesystem permissions of the Triton process.
Why it matters
The record maps this to CWE-36, absolute path traversal. An application that takes a file path from a caller and uses it without limiting where it can point can be steered to files outside its intended directory. For a model server that loads and stores files, that can expose data or let the wrong files be used.
The score is medium, but NVIDIA's own wording mentions code execution, so the practical risk depends on how exposed your server is. The record's KEV flag is false.
Quick check
Is CVE-2026-47606 exploited in the wild?
The record's KEV flag is false, and the pages I read do not say it is exploited. Treat it as a patch item and keep an eye on the advisory for changes.
Which Triton release fixes it?
I could not confirm it from the pages I could read. NVIDIA's bulletin 5865 is the source for the fixed release.
Sources
Last reviewed: 19 October 2026.
