NVIDIA Triton Inference Server Container Escape via Malformed Model Configuration
Overview
A critical vulnerability was identified in the NVIDIA Triton Inference Server, which could allow an attacker to escape the container and execute code on the host operating system. The flaw, designated CVE-2026-19845, exists in the server's model repository parsing logic. Triton polls model repositories for new or updated models, and a flaw in the parsing of the `config.pbtxt` file for ONNX models could lead to a heap buffer overflow. By crafting a malicious configuration file with an excessively long string for a specific parameter, an attacker with permissions to upload models to a repository monitored by Triton could trigger the overflow. Successful exploitation overwrites memory in the Triton process, enabling arbitrary code execution. Since Triton is often run with elevated privileges to access GPU hardware, this can lead to a full host compromise. The vulnerability is especially dangerous in MLOps environments where developers or automated CI/CD pipelines have access to model repositories. The bug was discovered by researchers from the Google Project Zero team. NVIDIA has released updated container images and a software patch to address this issue.
Affected Systems
Testing Guide
1. Check your Triton server version. You can do this by inspecting the container tag or by querying the server's metadata endpoint. 2. If write access to the model repository is possible, create a `config.pbtxt` file for a dummy ONNX model. 3. In the config file, set the `name` field within an `input` block to a string of over 8192 bytes. 4. Place this model in the repository and monitor the Triton server logs. A vulnerable server will crash with a segmentation fault or memory corruption error.
Mitigation Steps
1. Update to the latest NVIDIA Triton Inference Server container image (version `24.04` or newer) from the NVIDIA NGC catalog. 2. If using a custom build, apply the source code patch released by NVIDIA and rebuild the server. 3. Restrict write access to model repositories to only trusted administrators and automated service accounts. 4. Run Triton in a rootless container environment (e.g., using Podman) or with a stricter seccomp profile to limit the kernel attack surface and syscalls available to the process, reducing the impact of a successful escape.
Patch Details
Patched in Triton Inference Server version 24.04. The fix adds proper bounds checking to the model configuration parser.