What is the CVSS score of CVE-2026-28500?

CVE-2026-28500 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of ONNX are affected by CVE-2026-28500?

ONNX Python package versions 1.20.1 and earlier contain a critical supply-chain vulnerability that silently downloads and executes arbitrary model files from attacker-controlled repositories when the…. A patch is available.

How to fix or mitigate CVE-2026-28500?

Within 24 hours: Audit all applications using onnx.hub.load() to identify instances passing silent=True parameter and disable this parameter immediately. Within 7 days: Upgrade ONNX to version 1.21.0rc1 or later across all production and development environments. Within 30 days: Review Git repository sources in model loading workflows, implement GitHub repository allowlisting for authorized model sources, and conduct security audit of previously downloaded models.

ONNX CVE-2026-28500

CRITICAL

Insufficient Verification of Data Authenticity (CWE-345)

2026-03-16 https://github.com/onnx/onnx

GHSA-hqmj-h5c6-369m

Python Information Disclosure

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

AC:H because exploitation needs the non-default silent=True plus an attacker-controlled repo reference; PR:N/UI:N as no victim auth or prompt occurs once silent is set; C:H/I:H for credential exfiltration and malicious model integrity, A:N per described impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Red Hat

8.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 03:59 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 03:56 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 03:55 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jun 30, 2026 - 03:54 vuln.today

Analysis Updated

Jun 30, 2026 - 03:54 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:24 vuln.today

cvss_changed

Severity Changed

Jun 30, 2026 - 03:24 NVD

HIGH CRITICAL

CVSS changed

Jun 30, 2026 - 03:24 NVD

8.6 (HIGH) 9.1 (CRITICAL)

Patch released

Apr 07, 2026 - 02:30 nvd

Patch available

Analysis Generated

Mar 16, 2026 - 17:20 vuln.today

CVE Published

Mar 16, 2026 - 16:23 nvd

HIGH 8.6

DescriptionNVD

Summary

A security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading models from non-official sources, the use of the silent=True parameter completely suppresses all security warnings and confirmation prompts.

The Technical Flaw

The vulnerability is located in onnx/hub.py. The security gate uses a short-circuit evaluation that prioritizes the "silent" preference over the trust requirement:

Python

if not _verify_repo_ref(repo) and not silent:
# This block (Warning + User Input) is SKIPPED if silent=True
    print("The model repo... is not trusted")
    if input().lower() != "y":
        return None

Key Points of Failure: Complete Suppression: If a developer or a third-party library sets silent=True, the application will download and execute models from any attacker-controlled GitHub repository without notifying the user. Integrity Verification Bypass: The SHA256 integrity check validates the model against a manifest file. Since the attacker controls the repository, they also control the manifest, allowing them to provide a "valid" hash for a malicious model.

Impact

This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks. When chained with file-system vulnerabilities , an attacker can silently exfiltrate sensitive files ( SSH keys, cloud credentials) from the victim's machine the moment the model is loaded.

AnalysisAI

Silent supply-chain compromise in the ONNX Python package (pip/onnx <= 1.20.1) arises because passing silent=True to onnx.hub.load() suppresses every untrusted-repository warning and confirmation prompt, letting models download and execute from any attacker-controlled GitHub repo with zero user awareness. Because the SHA256 manifest lives in the same attacker-owned repo, the integrity check is self-defeating and always validates the malicious model. There is no public exploit identified at time of analysis and EPSS is very low (0.01%), but the issue is fixed in 1.21.0rc1 and carries a vendor CVSS of 9.1.

Technical ContextAI

ONNX (Open Neural Network Exchange) is a widely used open standard and Python library for representing and exchanging machine-learning models; onnx.hub.load() is a convenience helper that fetches pretrained models from remote GitHub repositories using a manifest. The flaw lives in onnx/hub.py, where the trust gate is written as if not _verify_repo_ref(repo) and not silent: - a short-circuit that prioritizes the caller's silent preference over the trust requirement, so the warning and the interactive input() confirmation are skipped entirely when silent=True. This maps to CWE-345 (Insufficient Verification of Data Authenticity): the SHA256 integrity check only compares the model against a manifest stored in the same repository, so an attacker controlling the repo controls both the model and its 'valid' hash, defeating authenticity verification. Affected package per CPE is pkg:pip/onnx.

RemediationAI

Vendor-released patch: upgrade onnx to 1.21.0rc1 or later, where the maintainers resolved the issue by removing the trust-suppression feature entirely (per GHSA-hqmj-h5c6-369m). On Red Hat systems, apply RHSA-2026:24977. Until you can upgrade, the most effective compensating control is to audit your codebase and any third-party libraries for calls to onnx.hub.load() and remove the silent=True argument so the trust warning and confirmation prompt are restored - the trade-off is that automated/non-interactive pipelines will block on the input() prompt and must be reworked to pin trusted repos. Additionally, only load models from the official onnx model zoo or repos you control (pass explicit, verified repo references rather than user/third-party-supplied strings), and run model-loading workloads in a sandboxed, least-privilege environment with no access to SSH keys or cloud credentials to blunt the exfiltration chain described in the advisory. Advisory URLs: https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m and the write-up at https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md.