CVE-2026-28500: ONNX security bypass in onnx.hub.load via silent parameter

CVE-2026-28500 · Severity: high · CVSS 8.6 · Published 2026-03-18

ONNX is an open-source format used to exchange machine learning models between different software tools. A security flaw in its model-loading function allows models from untrusted sources to be downloaded and executed without any warning or user confirmation. This could allow an attacker to silently steal sensitive information, such as cloud credentials or encryption keys, from a developer's machine or automated pipeline.

Technologies: onnx (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-28500 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-28500 being exploited in the wild.
How severe is CVE-2026-28500?
High severity, with a CVSS score of 8.6, published 18 March 2026.
Which products and versions are affected?
onnx (PyPI) <= 1.20.1, ECOSYSTEM:introduced=0,fixed=1.21.0rc1.
Is there a fix for CVE-2026-28500?
Yes. onnx (PyPI): upgrade to 1.21.0rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28500 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-28500?
Check whether you run onnx (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • onnx (PyPI): upgrade to 1.21.0rc1 or later
    pip install "onnx>=1.21.0rc1"

Technical details

A security control bypass exists in the onnx.hub.load() function due to improper logic in the repository trust verification mechanism. When the 'silent=True' parameter is used, the library suppresses all security warnings and confirmation prompts that would normally trigger when loading models from non-official sources. Furthermore, the SHA256 integrity check is ineffective because it validates against a manifest hosted within the same attacker-controlled repository. An attacker can exploit this to perform zero-interaction supply-chain attacks, potentially achieving arbitrary code execution or sensitive file exfiltration if chained with other vulnerabilities. The issue is addressed in version 1.21.0 by removing the problematic feature.

Affected products

  • onnx onnx <= 1.20.1
  • Red Hat Red Hat OpenShift AI 2.25

Identifiers

  • CVE-2026-28500
  • GHSA-hqmj-h5c6-369m
  • PYSEC-2026-103

Timeline

  • 2026-03-16: advisory: GitHub advisory published by ONNX maintainers
  • 2026-03-18: disclosed: NVD publication date
  • 2026-06-10: patched: Red Hat released fixes for OpenShift AI via RHSA-2026:24977

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.