CVE-2026-24207 — NVIDIA Triton SageMaker Auth Bypass to Unauth RCE

Unauthenticated attackers can reach the model-management surface of NVIDIA Triton Inference Server on the SageMaker and Vertex AI HTTP ports — bypassing the operator's --http-restricted-api configuration. Combined with the SageMaker MME LOAD primitive and a Python-backend model, this enables pre-auth remote code execution as the Triton process user when the attacker can place model files on a Triton-readable filesystem path.

• CVE: CVE-2026-24207 (SageMaker — PoC + RCE chain) · CVE-2026-24206 (Vertex AI — structurally identical sibling, analysis only)
• CWE-288 · CVSS 9.8 Critical (NVIDIA CNA) — NIST/NVD not yet scored
• Vendor: NVIDIA Corporation · Product: Triton Inference Server
• Write-up: offseckit.com/blog/cve-2026-24207

Scope. The PoC scripts reproduce CVE-2026-24207 (SageMaker) end-to-end, including the unauth-RCE chain, verified against the official NVIDIA NGC containers. CVE-2026-24206 (Vertex AI) is the structurally identical sibling bug — confirmed by source/patch review of PR #8680 (docs/root-cause.md, docs/patch-diff.md), not lab-reproduced.

Affected versions

Quick start

Check if a device is patched (defenders)

python3 detect.py <host:sagemaker_port>

Sends one read-only GET. Prints PATCHED, VULNERABLE, or UNKNOWN. Makes no changes.

Understand the bypass (researchers)

python3 bypass_demo.py <host:sagemaker_port>

Sends three probes — health (always succeeds), /models WITH the configured auth header (authorized baseline), and /models WITHOUT the header (the bypass). Side-by-side response codes show the behavior difference. No state change. See docs/root-cause.md.

Demonstrate impact (authorized testing only)

# Probe the model-management surface (enumerate + LOAD attempt + UNLOAD attempt)
python3 exploit.py <host:sagemaker_port>

# Full RCE chain — point Triton at a path you control on its filesystem
python3 exploit.py <host:sagemaker_port> --mode rce \
        --url /opt/ml/models/<your-attacker-dir> \
        --name chaindemo

The --mode rce flow loads a Python-backend model from a user-supplied path. If the directory contains a valid config.pbtxt

• model.py (see example/ for a benign demo), the model.py executes as the Triton process user — pre-auth.

See docs/rce-chain.md for the chain mechanics and prerequisites.

Files

Requirements

Python 3.8+ and requests:

pip install requests

Credits

Independent post-patch analysis and PoC by 4252nez — write-up on OffSecKit. Original vulnerabilities reported by Hyeonjun Ahn (@deayzl) and credited in NVIDIA's May 2026 security bulletin; this repository has no affiliation with that report.

License

MIT — see LICENSE.