A critical vulnerability in NVIDIA’s Riva framework—a platform for AI-powered speech recognition and translation—has exposed cloud environments to potential unauthorized access and exploitation.
Researchers at Trend Micro have identified two security flaws, tracked as CVE-2025-23242 and CVE-2025-23243, caused by misconfigured deployments that publicly expose Riva’s gRPC and Triton Inference Server endpoints.
These vulnerabilities allow attackers to bypass authentication, misuse GPU resources, and potentially exfiltrate proprietary AI models or disrupt services through denial-of-service (DoS) attacks. Affected systems primarily include Linux-based deployments running Riva versions up to 2.18.0, which lack essential SSL/TLS protections and proper network isolation.
Threat actors exploiting these flaws can access sensitive APIs without credentials, using exposed ports—50051 for gRPC and 8000–8002 for Triton—to issue arbitrary inference requests.
Such attacks present serious financial and operational risks, including unauthorized API usage leading to inflated cloud bills, or intellectual property theft if custom AI models are compromised.
According to Trend Micro, the root cause lies in Riva’s default container settings, which bind services to all network interfaces (0.0.0.0) without enforcing client authentication.
“Even when SSL/TLS is enabled, the absence of mutual authentication means that any client can still connect to secured endpoints,” said Alfredo Oliveira, a lead researcher at Trend Micro’s Zero Day Initiative.
This misconfiguration creates a false sense of security, leaving systems vulnerable to abuse or lateral movement within cloud environments, especially through exposed Triton Inference Server instances.
The primary attack vector centers on Riva’s insecure gRPC setup, which defaults to unencrypted communication unless administrators explicitly enable SSL/TLS via the config.sh script.
NVIDIA Riva’s Pipeline Vulnerabilities (Source: Trend Micro)
Trend Micro’s investigation revealed that even Riva deployments configured with SSL/TLS fail to validate client certificates, leaving systems vulnerable to unauthenticated access.
The following Python snippet illustrates how an attacker can exploit this flaw to connect to an exposed Riva server:
import grpc
Insecure connection to exposed Riva server
channel = grpc.insecure_channel(“target_ip:50051”)
stub = riva_proto.RivaSpeechStub(channel)
Example: Accessing text-to-speech API without authentication
response = stub.TextToSpeech(riva_proto.TextToSpeechRequest(text=”Exploit sample”))
This lapse in certificate validation allows attackers to bypass API key-based billing systems and misuse GPU resources for malicious purposes such as cryptomining or adversarial model training.
Worsening the situation, Riva’s internal Triton Inference Server endpoints are also left exposed via ports 8000–8002. Attackers can use these to directly access Triton’s HTTP/REST and gRPC APIs, submitting inference requests or probing for model-specific vulnerabilities.
Trend Micro also discovered that outdated Triton versions are susceptible to memory corruption via malformed inference inputs, potentially leading to buffer overflows and remote code execution.
The risks are magnified by the fact that Riva containers often run with elevated privileges. A successful compromise could allow attackers to escalate privileges, gaining control over Kubernetes clusters or cloud infrastructure.
To mitigate these threats, organizations should upgrade to Riva version 2.19.0, which introduces support for client certificate validation and enforces stricter network isolation. Administrators should also:
- Restrict inbound traffic to trusted IP addresses via security group settings.
- Implement role-based access controls (RBAC) for all Triton endpoints.
As AI services become more tightly integrated with cloud platforms, this incident highlights the urgency of adopting zero-trust security architectures in GPU-accelerated environments.
