NVIDIA Triton Inference Server Model Repository Path Traversal
Overview
A path traversal vulnerability was identified in the NVIDIA Triton Inference Server's model loading mechanism when utilizing a local filesystem model repository. An attacker with privileges to write or modify files in the model repository could cause Triton to read arbitrary files from the server's filesystem. The flaw stemmed from insufficient validation of file path parameters within a model's `config.pbtxt` file. By crafting a configuration that used '`../`' sequences in a model's version or library path definitions, an attacker could direct the server to load files from outside the intended model repository directory. This could be exploited to exfiltrate sensitive data, such as SSH private keys, application secrets, or proprietary data and models stored on the same server. Successful exploitation requires the ability to manipulate the model repository, a scenario common in multi-tenant MLOps platforms or environments where developers have direct access to the model store. The impact is unauthorized file read access with the permissions of the Triton server process, which is often `root` if not properly configured.
Affected Systems
Testing Guide
1. In your model repository, create a new model directory (e.g., `traverse-test/1/`). 2. Create a `model.py` file (its content does not matter). 3. Create a `config.pbtxt` file in the `traverse-test` directory with the following content: `name: "traverse-test" backend: "python" input [ { name: "INPUT0", data_type: TYPE_FP32, dims: [ -1 ] } ] output [ { name: "OUTPUT0", data_type: TYPE_FP32, dims: [ -1 ] } ] instance_group [ { kind: KIND_CPU } ] default_model_filename: "../../../../../../etc/passwd"` 4. Start the Triton server pointing to this repository. 5. Attempt to load the model via a Triton API call. If the server logs show an error related to parsing `/etc/passwd` as a model file, it confirms the traversal was successful.
Mitigation Steps
1. Upgrade Triton Inference Server to version 2.45.0 or newer (distributed with NGC container `25.10` and later). 2. Run the Triton server process as a dedicated, low-privilege user to limit the impact of a successful file read. 3. Implement strict access controls, integrity checks, and validation on any CI/CD pipeline or user-facing process that allows uploading models to the repository. 4. Use container security mechanisms like AppArmor, SELinux, or Seccomp to strictly confine Triton's file access to only the necessary directories.
Patch Details
Version 2.45.0, included in the NGC Triton container version 25.10, introduces robust path sanitization and realpath canonicalization to ensure model-related files are only loaded from within the designated repository directory.