Remote Code Execution in NVIDIA Triton Inference Server via Malicious ONNX Model
Overview
A heap-based buffer overflow vulnerability was discovered in the ONNX Runtime backend of the NVIDIA Triton Inference Server. The vulnerability, identified as CVE-2026-31337, can be triggered when the server attempts to load a specially crafted ONNX model file. An attacker with the ability to submit models to the server—a common scenario in MLOps environments where multiple teams share an inference cluster—can exploit this flaw. The crafted model contains malformed tensor shape information that, when parsed by the ONNX backend, causes an overflow during memory allocation for the model's computation graph. This overflow can corrupt adjacent memory structures on the heap, allowing the attacker to achieve arbitrary code execution. Successful exploitation results in code running with the permissions of the Triton server process. This could enable an attacker to steal all models loaded on the server, intercept and manipulate inference requests and responses for other models, exfiltrate sensitive data being processed, or use the server as a pivot point to attack the underlying host and the broader network. The issue affects all versions of Triton prior to 2.45.0.
Affected Systems
Testing Guide
1. Check your Triton Inference Server version. You can typically find this in startup logs or by querying the server's metadata endpoint. 2. If the version is below 2.45.0, you are vulnerable. 3. A proof-of-concept exploit involves crafting an ONNX file with specific out-of-bounds values in its graph definition. A security team can attempt to load this PoC model in a sandboxed environment to confirm the crash and potential for code execution.
Mitigation Steps
1. Upgrade the NVIDIA Triton Inference Server to version `2.45.0` or later, which contains a patch for the affected ONNX Runtime backend. 2. If immediate upgrade is not possible, restrict model loading permissions to a small, trusted group of administrators. 3. Implement a model scanning and validation pipeline that checks for structural anomalies in submitted model files before they are loaded by the Triton server. 4. Run the Triton server in a container with minimal privileges and strict network egress policies to limit the impact of a potential compromise.
Patch Details
Patch is available in Triton Inference Server version 2.45.0 and all subsequent releases.