Full Report
Wiz Research discovers a critical vulnerability chain allowing unauthenticated attackers to take over NVIDIA's Triton Inference Server.
Analysis Summary
# Vulnerability: Chained RCE via Information Leak in NVIDIA Triton Inference Server
## CVE Details
- CVE ID: CVE-2025-23319, CVE-2025-23320, CVE-2025-23334 (A chain of flaws leading to RCE)
- CVSS Score: Critical (Specific score not provided, but context indicates RCE capability)
- CWE: Not explicitly detailed for the chain, but related to information leaks and potentially improper input validation.
## Affected Systems
- Products: NVIDIA Triton Inference Server (Open-source platform for running AI models)
- Versions: All versions prior to the patch addressing these CVEs.
- Configurations: Exploitation path originates in the server's Python backend.
## Vulnerability Description
A chain of critical vulnerabilities was discovered in the NVIDIA Triton Inference Server, originating from the Python backend. Initially involving a minor information leak, this flaw can be cleverly escalated through interaction with the main server functionality to achieve complete system compromise, resulting in Remote Code Execution (RCE).
## Exploitation
- Status: PoC available (Implied by the successful research and disclosure; RCE is demonstrated via chaining flaws).
- Complexity: Likely Medium to High, as it requires chaining multiple vulnerabilities.
- Attack Vector: Network (Remote, unauthenticated attacker).
## Impact
- Confidentiality: High (Theft of valuable AI models and exposure of sensitive data being processed).
- Integrity: High (Ability to manipulate the AI model's output/responses).
- Availability: High (System compromise leading to service disruption or full control).
## Remediation
### Patches
- Users must upgrade both the NVIDIA Triton Inference Server and the Python backend to **version 25.07** or later as advised in the NVIDIA security bulletin.
### Workarounds
- No explicit workarounds are detailed, but the implicit mitigation is to restrict network access to the Triton Inference Server until patching can be performed.
## Detection
- **Indicators of Compromise:** None specifically listed (e.g., specific log entries for the leak), but successful exploitation means a full system compromise.
- **Detection Methods and Tools:** Wiz customers are advised to use Wiz platform features (Vulnerability Findings page, Security Graph) filtering by CVE identifiers: `CVE-2025-23319`, `CVE-2025-23320`, and `CVE-2025-23334`.
## References
- Vendor Advisory: hxxps://nvidia-custhelp-com/app/answers/detail/a_id/5687
- Research Disclosure (Wiz): hxxps://www-wiz-io/blog/nvidia-ai-vulnerability-chain-triton-rce (Based on context of the article)