ubuntu-cve-2026-28500
Vulnerability from osv_ubuntu
Published
2026-03-18 02:16
Modified
2026-06-30 16:19
Summary
Details

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading models from non-official sources, the use of the silent=True parameter completely suppresses all security warnings and confirmation prompts. This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks. When chained with file-system vulnerabilities, an attacker can silently exfiltrate sensitive files (SSH keys, cloud credentials) from the victim's machine the moment the model is loaded. As of time of publication, no known patched versions are available.

Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
N/A (UNKNOWN)
medium
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libonnx-testdata",
            "binary_version": "1.7.0+dfsg-3ubuntu2"
          },
          {
            "binary_name": "libonnx1",
            "binary_version": "1.7.0+dfsg-3ubuntu2"
          },
          {
            "binary_name": "libonnxifi",
            "binary_version": "1.7.0+dfsg-3ubuntu2"
          },
          {
            "binary_name": "python3-onnx",
            "binary_version": "1.7.0+dfsg-3ubuntu2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "onnx",
        "purl": "pkg:deb/ubuntu/onnx@1.7.0+dfsg-3ubuntu2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.7.0+dfsg-3build1",
        "1.7.0+dfsg-3build2",
        "1.7.0+dfsg-3ubuntu1",
        "1.7.0+dfsg-3ubuntu2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libonnx-testdata",
            "binary_version": "1.14.1-2.1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libonnx1t64",
            "binary_version": "1.14.1-2.1ubuntu0.1~esm1"
          },
          {
            "binary_name": "python3-onnx",
            "binary_version": "1.14.1-2.1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "onnx",
        "purl": "pkg:deb/ubuntu/onnx@1.14.1-2.1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.13.1-3",
        "1.13.1-3build1",
        "1.14.1-2",
        "1.14.1-2.1",
        "1.14.1-2.1build1",
        "1.14.1-2.1build2",
        "1.14.1-2.1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libonnx-testdata",
            "binary_version": "1.17.0-3build1"
          },
          {
            "binary_name": "libonnx1t64",
            "binary_version": "1.17.0-3build1"
          },
          {
            "binary_name": "python3-onnx",
            "binary_version": "1.17.0-3build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "onnx",
        "purl": "pkg:deb/ubuntu/onnx@1.17.0-3build1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.17.0-3build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libonnx-testdata",
            "binary_version": "1.20.0-1"
          },
          {
            "binary_name": "libonnx1t64",
            "binary_version": "1.20.0-1"
          },
          {
            "binary_name": "python3-onnx",
            "binary_version": "1.20.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "onnx",
        "purl": "pkg:deb/ubuntu/onnx@1.20.0-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.17.0-3build1",
        "1.20.0-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading models from non-official sources, the use of the silent=True parameter completely suppresses all security warnings and confirmation prompts. This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks. When chained with file-system vulnerabilities, an attacker can silently exfiltrate sensitive files (SSH keys, cloud credentials) from the victim\u0027s machine the moment the model is loaded. As of time of publication, no known patched versions are available.",
  "id": "UBUNTU-CVE-2026-28500",
  "modified": "2026-06-30T16:19:40Z",
  "published": "2026-03-18T02:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-28500"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28500"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-28500"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.