Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
- AIDEFEND SecureFlow — NVIDIA Triton Python Backend Unauthenticated RCE Chain
- Breaking NVIDIA Triton: CVE-2025-23319 - A Vulnerability Chain Leading to AI Server Takeover (Wiz Research)
- Security Bulletin: NVIDIA Triton Inference Server - August 2025
- CVE-2025-23319 Detail (NVD)
- CVE-2025-23320 Detail (NVD)
- CVE-2025-23334 Detail (NVD)
Wiz disclosed a chain in NVIDIA Triton Inference Server's Python backend where an unauthenticated remote request leaks an internal shared-memory name, the public shared-memory API accepts that private key, attacker-controlled requests gain read/write access to backend IPC memory, and memory or IPC corruption can lead to remote code execution and AI-server takeover.
ASSESSED SYSTEM
Representative configuration: an NVIDIA Triton Inference Server deployment, in a release affected by the disclosed Python-backend vulnerability chain (CVE-2025-23319, CVE-2025-23320, and CVE-2025-23334), serving a model through the Python backend with its inference and shared-memory registration APIs reachable by remote clients without authentication. Scored in the pre-patch state Wiz Research disclosed.
OUT OF SCOPE
Triton deployments without the Python backend or whose APIs are reachable only by authenticated, trusted clients; releases patched under NVIDIA's August 2025 security bulletin; the specific models and data served, which the record does not identify; model theft, response manipulation, and lateral movement, which the record describes as possible after compromise rather than observed; and the attacker's exploit tooling.
Architecture: Traditional ML / Classifier (decision tree Q6) — Host-inheritance rule: the architecture is that of the AI workload Triton serves. The record identifies a general-purpose model-serving host and its Python backend but establishes no generative interface, inference-time retrieval, tool or function calling, autonomous planner, or agent coordination for the served model, so Q1-Q5 resolve NO on the published evidence and the decision tree ends at Q6 by elimination. The serving-runtime compromise enters as Containment, As, and Cp evidence. Tier 1: Tier 1 because unauthenticated remote requests could reach private backend IPC memory and, through the disclosed chain, code execution on production AI-serving infrastructure, matching the Tier 1 treatment of the sglang-zmq-pickle-deserialization-rce serving-runtime precedent.
Documented attack or failure path
- The attacker sends remote requests to a Triton Inference Server Python backend without prior authentication, reaching the request and shared-memory surfaces the chain needs.
- A crafted large request triggers error handling that exposes the unique internal IPC shared-memory region name used by the Python backend stub process.
- Using the leaked key, the attacker calls Triton's user-facing shared-memory registration API, which fails to distinguish a legitimate user-owned region from the backend's internal IPC region.
- Subsequent inference requests use the internal region for input or output, giving the attacker read and write primitives into private Python-backend IPC memory and related control structures.
- Writes to backend data structures or crafted IPC messages create paths toward memory corruption or logical exploitation, which the disclosure states can lead to remote code execution and takeover of the model-serving host.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 1 MVT 0.60 indeterminate | |||
| Fairness (Fa) NOT APPLICABLE — axis-level applicability rule (Person-Outcome Surface test): The assessed system is the Triton Inference Server serving runtime and its shared-memory IPC surface; its outputs are inference results and error responses to remote clients, and no natural-person outcome or protected-class attribute or proxy is evidenced within the assessed boundary. Its tier weight is redistributed across the remaining axes and its MVT is not evaluated. | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 1 MVT 0.55 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 1 MVT 0.60 indeterminate | |||
| Containment (Cn) — scenario interval 0.06–0.46 (midpoint 0.26), Tier 1 MVT 0.65 confirmed breach | |||
| Cn-1Scope Enforcement | 0.25w 0.23 | The 0.25 anchor: a basic boundary exists (shared-memory registration is a scoped user feature) but simple parameter manipulation, supplying a leaked internal key, exceeded the intended scope. The 0.50 anchor requires core scope controls that block common violations, and this one was bypassed by a single crafted parameter. | Triton's user-facing shared-memory registration API accepted the backend's private IPC shared-memory key supplied by a remote caller, failing to distinguish a legitimate user-owned region from the backend's internal region, after which inference requests could read and write private Python-backend IPC memory and control structures.source: secureflow |
| Cn-4Side-Channel Resistance | 0.00w 0.28 | The 0.00 anchor: an error channel revealed sensitive internal state to an unauthenticated caller. The 0.25 anchor requires basic error handling that withholds such state, leaving only subtler timing, cache, or resource channels exploitable; here the error response itself disclosed the secret. | A crafted large request triggered error handling that exposed the unique internal IPC shared-memory region name used by the Python backend stub process to the remote caller, supplying the key on which the rest of the chain depended.source: secureflow |
| Cn-5Agent Identity Integrity | 0.00w 0.08 | The 0.00 anchor: the serving interfaces accepted unauthenticated calls from an arbitrary caller identity. The 0.25 anchor requires at least API-key or shared-secret authentication, which the assessed configuration did not enforce. | The attacker could send remote requests to the Triton Python backend, including the inference and shared-memory registration surfaces the chain required, without prior authentication.source: secureflow |
Unknown, not N/A: 16 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Architecture-based NOT APPLICABLE: declared with an architecture rationale in the workpaper: Cn-6; NOT APPLICABLE by design for this architecture class: Cn-8, Cn-9; excluded with the Fairness axis.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.25w 0.35 | The serving runtime returns inference results to callers and holds no tool-calling, transaction, or autonomous decision authority; it is placed at 0.25 rather than 0.00 because served outputs flow to automated consumers without per-output human review, following the serving-runtime precedents. |
| AsAttack Surface Exposure | 0.75w 0.25 | Remote clients can reach the inference and shared-memory APIs without authentication, so unvalidated external requests enter the runtime directly. Internet exposure, multi-agent, or MCP surfaces are not established, so 1.00 is not supported. |
| CpCascade Potential | 1.00w 0.25 | No verified System Dependency Graph with DGC at least 0.90 is public for this boundary, so the specification's worst-case graph default governs rather than an assessor-estimated blast radius.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.00w 0.15 | Deterministic fix: NVIDIA's August 2025 security bulletin addresses the disclosed vulnerabilities through a Triton software update that changes no served model; restricting API reachability to authenticated clients is a configuration change in the same class. It does not assert fleet-wide closure. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.35 | The public record identifies the representative configuration, attack path, and principal control boundaries, but does not provide a complete asset manifest, verified dependency graph, configuration export, or assessment evidence manifest. |
| Ec — Public evaluation coverage | 0.13 | coverage 0.16 (3 of 19 applicable sub-metrics) × independence 1.00 × fidelity 0.85. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.00 | Evidence dated 2025-08-04; age 440 days on the workpaper reference date. Components: T_calendar 0.00 · C_monitor 0.65 · C_event 0.65 · C_evidence 0.85. Binding term: T_calendar. Evidence age is measured from the Wiz Research disclosure dated 2025-08-04 to the 2026-10-18 evidence reference date. C_monitor 0.65: the chain was found by external research and no deployment-side detection is described. C_event 0.65: no in-the-wild exploitation is reported. C_evidence 0.85: closure depends on each deployment applying the vendor update and restricting API reachability, which the public record cannot confirm. agentic = false and baw = false: the serving runtime has no runtime tool, credential, memory, or configuration mutation inside the boundary. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.01 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
3.2 midpoint, interval 1.1–5.2; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS · 3 records
CVE-2025-23319 CVSS 3.1 Base 8.1 High
| Published score | 8.1 |
|---|---|
| CVSS version | 3.1 |
| Metric group | Base |
| Severity | High |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Scored by | nvidia |
| Source record | https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/23xxx/CVE-2025-23319.json (accessed 2026-10-18) |
| Affected component | Triton Inference Server |
| Scope note | CNA affected product and described vulnerability match the scored assessed_system and are not excluded by out_of_scope. |
| Record SHA-256 | 4db22a715c58e7b526d3d2c1649817624b4367692a8aafb7dcaa23f05c6abc40 |
CVE-2025-23320 CVSS 3.1 Base 7.5 High
| Published score | 7.5 |
|---|---|
| CVSS version | 3.1 |
| Metric group | Base |
| Severity | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Scored by | nvidia |
| Source record | https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/23xxx/CVE-2025-23320.json (accessed 2026-10-18) |
| Affected component | Triton Inference Server |
| Scope note | CNA affected product and described vulnerability match the scored assessed_system and are not excluded by out_of_scope. |
| Record SHA-256 | 4f74bfdffa3c60d944d33ffb560a74f03fca2bcbdf99574b220f530fb18d4a6d |
CVE-2025-23334 CVSS 3.1 Base 5.9 Medium
| Published score | 5.9 |
|---|---|
| CVSS version | 3.1 |
| Metric group | Base |
| Severity | Medium |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Scored by | nvidia |
| Source record | https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/23xxx/CVE-2025-23334.json (accessed 2026-10-18) |
| Affected component | Triton Inference Server |
| Scope note | CNA affected product and described vulnerability match the scored assessed_system and are not excluded by out_of_scope. |
| Record SHA-256 | 68795c98f00beeb525b3dffa513740473157bc1c7a0ff55b49c7955e40d2323a |
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-004.002 | Service & API AuthenticationExact SecureFlow defense-map identifier (flow aidefend-research-sf0022-nvidia-triton-unauthenticated-python-backend-rce), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-1. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-5 |
| AID-I-002.001 | Internal AI Network SegmentationExact SecureFlow defense-map identifier (flow aidefend-research-sf0022-nvidia-triton-unauthenticated-python-backend-rce), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-1, step-7. Presence supplies no score credit. | Candidate evidence route | Cn-4 |
| AID-H-032.003 | Inference Telemetry & Debug Surface RestrictionExact SecureFlow defense-map identifier (flow aidefend-research-sf0022-nvidia-triton-unauthenticated-python-backend-rce), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-2. Presence supplies no score credit. | Candidate evidence route | Pr-2 Pr-4 Cn-4 |
| AID-I-001.002 | MicroVM & Low-Level SandboxingExact SecureFlow defense-map identifier (flow aidefend-research-sf0022-nvidia-triton-unauthenticated-python-backend-rce), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Pr-2 Cn-7 |
| AID-E-002 | AI Runtime Process, Lease & Pod EvictionExact SecureFlow defense-map identifier (flow aidefend-research-sf0022-nvidia-triton-unauthenticated-python-backend-rce), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | ACI:containment/behavioral re-attestation ORP:Rf remediation evidence |
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleExact SecureFlow defense-map identifier (flow aidefend-research-sf0022-nvidia-triton-unauthenticated-python-backend-rce), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Tr-4 |
| AID-E-004 | Incident Exploit-Path Closure VerificationExact SecureFlow defense-map identifier (flow aidefend-research-sf0022-nvidia-triton-unauthenticated-python-backend-rce), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | ACI:C_event recovery ACI:containment/behavioral re-attestation |
WHAT THIS CASE TEACHES
A serving runtime's own error path can hand an unauthenticated caller the key to its private memory: Cn-4 and Cn-5 at 0.00 and Cn-1 at 0.25 show that information leakage, caller identity, and API scope compose into one chain that no single sub-metric captures, while a deterministic vendor patch keeps Rf at 0.00.
Sources: AIDEFEND SecureFlow — NVIDIA Triton Python Backend Unauthenticated RCE Chain · Breaking NVIDIA Triton: CVE-2025-23319 - A Vulnerability Chain Leading to AI Server Takeover (Wiz Research) · Security Bulletin: NVIDIA Triton Inference Server - August 2025 · CVE-2025-23319 Detail (NVD) · CVE-2025-23320 Detail (NVD) · CVE-2025-23334 Detail (NVD)
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (AIDEFEND curated research flow): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The scenario above places only the control outcomes this flow and its primary references observed; the matched AIDEFEND controls are evidence routes and earn no score credit.
| Primary research | Wiz Research and NVIDIA (2025-08-04) |
|---|---|
| Primary evidence date | 2025-08-04 |
| SecureFlow record updated | 2026-07-07 |
| AI layers | AI infrastructure |
| Risk impact | System compromise / RCE, Data exfiltration |
| Affected components | NVIDIA Triton Inference Server, Triton Python backend, backend IPC shared memory, shared memory registration API, inference request path, model-serving host |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Reach Unauthenticated Triton Inference EndpointThe attacker can send remote requests to a Triton Inference Server Python backend without prior authentication, giving them access to the request and shared-memory surfaces needed for the chain. | AML.TA0004 AML.T0049 |
| 2 | Send Large Request to Leak Shared Memory NameA crafted large request triggers error handling that exposes the unique internal IPC shared-memory region name used by the Python backend stub process. | AML.TA0008 AML.T0049 |
| 3 | Register Internal Shared Memory Key as User MemoryUsing the leaked private shared-memory key, the attacker calls Triton's user-facing shared-memory registration API, which fails to distinguish a legitimate user-owned region from the backend's internal IPC region. | AML.TA0005 AML.T0049 |
| 4 | Gain Read/Write Access to Backend IPC MemoryAfter registration succeeds, subsequent inference requests can use the internal region for input or output, giving the attacker read and write primitives into private Python backend IPC memory and related control structures. | AML.TA0009 AML.T0025 |
| 5 | Corrupt Backend Control Structures or IPC MessagesThe attacker uses shared-memory write access to alter backend data structures or craft malicious IPC messages, creating paths toward native memory corruption or logical exploitation. | AML.TA0005 AML.T0049 |
| 6 | Take Over Triton Server Through RCEThe chained vulnerabilities can give a remote unauthenticated attacker code execution and control of the model-serving host running Triton. | AML.TA0005 AML.T0049 |
| 7 | Steal Models, Data, or Pivot From AI ServerWith the inference server compromised, the attacker may steal proprietary models or sensitive inference data, manipulate model responses, or pivot deeper into the organization's network. | AML.TA0010 AML.T0025 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=aidefend-research-sf0022-nvidia-triton-unauthenticated-python-backend-rce; AIDEFEND content CC BY 4.0).