CVE-2024-0087 and the 2024 Triton Bulletins: The Year the Inference Server Became a Target
| CVE | Score | Bulletin | Disclosed |
|---|---|---|---|
| CVE-2024-0087 | 9.0 Critical | April 2024 | April 2024 |
| CVE-2024-0088 | 5.5 Medium | April 2024 | April 2024 |
| CVE-2024-0100 | 6.5 Medium | May 2024 | May 2024 |
| CVE-2024-0116 | — | September 2024 | September 2024 |
CVE-2024-0087 and CVE-2024-0088 discovered by pinkdraconian, lawliet, and Zhiniang Peng (Sangfor). CVE-2024-0116 discovered by r3pwnx.
For executives
Three separate Triton Inference Server security bulletins were issued in 2024. The first, in April, contained a critical vulnerability in the log configuration interface that allows an authenticated attacker to write to arbitrary files on the server. A public proof-of-concept exploit appeared within weeks. Belgium's Centre for Cybersecurity issued a public warning. The 2024 bulletins established the Triton Inference Server as a sustained research target.
CVE-2024-0087: arbitrary file write via log configuration (CVSS 9.0)
An attacker with high-level access to the Triton management API can set the logging output location to an arbitrary file path on the server's filesystem. By specifying a path to a security-sensitive file — a shell configuration file, a cron entry — the attacker can cause the server to write content to a location that results in code execution. Triton versions 22.09 through 24.03 for Linux are affected.
What the 2024 bulletins established
All 2024 disclosures require high-level access or specific preconditions. The 2025 disclosures are fundamentally different: the August 2025 Python backend RCE chain requires no credentials. The HTTP stack overflows are single-request, unauthenticated, CVSS 9.8. The trajectory from 2024 to 2025 is significant. In 2024, exploiting Triton required meaningful access. In 2025, it required a network connection.
Patch
CVE-2024-0087 and CVE-2024-0088 patched in releases after Triton 24.03.