CVE-2026-28500

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading models from non-official sources, the use of the silent=True parameter completely suppresses all security warnings and confirmation prompts. This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks. When chained with file-system vulnerabilities, an attacker can silently exfiltrate sensitive files (SSH keys, cloud credentials) from the victim's machine the moment the model is loaded. As of time of publication, no known patched versions are available.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md	Patch
https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m	Vendor Advisory
https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:linuxfoundation:onnx:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-18 02:16

Updated : 2026-03-18 19:47

NVD link : CVE-2026-28500

Mitre link : CVE-2026-28500

CVE.ORG link : CVE-2026-28500

JSON object : View

Products Affected

linuxfoundation

onnx

CWE

CWE-345

Insufficient Verification of Data Authenticity

CWE-494

Download of Code Without Integrity Check

CWE-693

Protection Mechanism Failure

{"id": "CVE-2026-28500", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2026-03-18T02:16:24.227", "references": [{"url": "https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md", "tags": ["Patch"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-345"}, {"lang": "en", "value": "CWE-494"}, {"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading models from non-official sources, the use of the silent=True parameter completely suppresses all security warnings and confirmation prompts. This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks. When chained with file-system vulnerabilities, an attacker can silently exfiltrate sensitive files (SSH keys, cloud credentials) from the victim's machine the moment the model is loaded. As of time of publication, no known patched versions are available."}, {"lang": "es", "value": "Open Neural Network Exchange (ONNX) es un est\u00e1ndar abierto para la interoperabilidad de aprendizaje autom\u00e1tico. En versiones hasta la 1.20.1 inclusive, existe un bypass de control de seguridad en onnx.hub.load() debido a una l\u00f3gica incorrecta en el mecanismo de verificaci\u00f3n de confianza del repositorio. Aunque la funci\u00f3n est\u00e1 dise\u00f1ada para advertir a los usuarios al cargar modelos de fuentes no oficiales, el uso del par\u00e1metro silent=True suprime completamente todas las advertencias de seguridad y las solicitudes de confirmaci\u00f3n. Esta vulnerabilidad transforma una funci\u00f3n est\u00e1ndar de carga de modelos en un vector para ataques de cadena de suministro de interacci\u00f3n cero. Cuando se encadena con vulnerabilidades del sistema de archivos, un atacante puede exfiltrar silenciosamente archivos sensibles (claves SSH, credenciales de la nube) de la m\u00e1quina de la v\u00edctima en el momento en que se carga el modelo. Al momento de la publicaci\u00f3n, no hay versiones parcheadas conocidas disponibles."}], "lastModified": "2026-03-18T19:47:59.707", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:onnx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "34920498-08A0-464E-B9F2-1562D29E3F26", "versionEndIncluding": "1.20.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}