Junglewise Threat Intelligence

CVE-2026-28500: ONNX security bypass in onnx.hub.load via silent parameter

CVE-2026-28500 · Severity: high · CVSS 8.6 · Published 2026-03-18

Executive brief

ONNX is an open-source format used to exchange machine learning models between different software tools. A security flaw in its model-loading function allows models from untrusted sources to be downloaded and executed without any warning or user confirmation. This could allow an attacker to silently steal sensitive information, such as cloud credentials or encryption keys, from a developer's machine or automated pipeline.

Technical details

A security control bypass exists in the onnx.hub.load() function due to improper logic in the repository trust verification mechanism. When the 'silent=True' parameter is used, the library suppresses all security warnings and confirmation prompts that would normally trigger when loading models from non-official sources. Furthermore, the SHA256 integrity check is ineffective because it validates against a manifest hosted within the same attacker-controlled repository. An attacker can exploit this to perform zero-interaction supply-chain attacks, potentially achieving arbitrary code execution or sensitive file exfiltration if chained with other vulnerabilities. The issue is addressed in version 1.21.0 by removing the problematic feature.

Affected products

  • onnx onnx <= 1.20.1
  • Red Hat Red Hat OpenShift AI 2.25

Timeline

  • 2026-03-16: advisory: GitHub advisory published by ONNX maintainers
  • 2026-03-18: disclosed: NVD publication date
  • 2026-06-10: patched: Red Hat released fixes for OpenShift AI via RHSA-2026:24977

References

Related threats