CVE-2026-34446
published 2026-04-01CVE-2026-34446: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the…
PriorityP426medium5.5CVSS 3.1
AVLACLPRNUIRSUCHINAN
EPSS
0.17%
6.0th percentile
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path traversal, but completely misses hardlinks because a hardlink looks exactly like a regular file on the filesystem. This issue has been patched in version 1.21.0.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | onnx | — | — |
| linuxfoundation | onnx | < 1.21.0 | 1.21.0 |
| msrc | azl3_pytorch_2.2.2-12_on_azure_linux_3.0 | — | — |
| msrc | cbl2_pytorch_2.0.0-15_on_cbl_mariner_2.0 | — | — |
| onnx | onnx | < 1.21.0 | 1.21.0 |
| onnx | onnx | >= 0 < 1.21.0 | 1.21.0 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_msrc4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-34446: (Open Neural Network Exchange (ONNX) is an open standard for machine le
osv·2026-04-02·CVSS 4.7
CVE-2026-34446 [MEDIUM] CVE-2026-34446: (Open Neural Network Exchange (ONNX) is an open standard for machine le
(Open Neural Network Exchange (ONNX) is an open standard for machine le ...)
OSV
CVE-2026-34446: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability
osv·2026-04-01·CVSS 4.7
CVE-2026-34446 [MEDIUM] CVE-2026-34446: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path traversal, but completely misses hardlinks because a hardlink looks exactly like a regular file on the filesystem. This issue has been patched in version 1.21.0.
OSV
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
osv·2026-04-01
CVE-2026-34446 [MEDIUM] ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
### Summary
The issue is in `onnx.load` — the code checks for symlinks to prevent path traversal, but completely misses hardlinks, which is the problem, since a hardlink looks exactly like a regular file on the filesystem.
### The Real Problem
The validator in `onnx/checker.cc` only calls `is_symlink()` and never checks the inode or `st_nlink`, so a hardlink walks right through every security check without any issues.
### Impact
Especially dangerous in AI supply chain scenarios like HuggingFace — a single malicious model is enough to silently steal secrets from the victim's machine without them noticing anything.
GHSA
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
ghsa·2026-04-01
CVE-2026-34446 [MEDIUM] CWE-22 ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
### Summary
The issue is in `onnx.load` — the code checks for symlinks to prevent path traversal, but completely misses hardlinks, which is the problem, since a hardlink looks exactly like a regular file on the filesystem.
### The Real Problem
The validator in `onnx/checker.cc` only calls `is_symlink()` and never checks the inode or `st_nlink`, so a hardlink walks right through every security check without any issues.
### Impact
Especially dangerous in AI supply chain scenarios like HuggingFace — a single malicious model is enough to silently steal secrets from the victim's machine without them noticing anything.
Microsoft
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
vendor_msrc·2026-04-02·CVSS 4.7
CVE-2026-34446 [MEDIUM] CWE-22 ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Red Hat
onnx: ONNX: Information disclosure through hardlink path traversal
vendor_redhat·2026-04-01·CVSS 4.7
CVE-2026-34446 [MEDIUM] CWE-41 onnx: ONNX: Information disclosure through hardlink path traversal
onnx: ONNX: Information disclosure through hardlink path traversal
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path traversal, but completely misses hardlinks because a hardlink looks exactly like a regular file on the filesystem. This issue has been patched in version 1.21.0.
A flaw was found in Open Neural Network Exchange (ONNX), an open standard for machine learning interoperability. The `onnx.load` function, which is used to load machine learning models, does not correctly handle hardlinks. This vulnerability could allow an attacker to create a specially crafted ONNX model that, when loaded by a user, could lead to the disclosure of sens
Debian
CVE-2026-34446: onnx - Open Neural Network Exchange (ONNX) is an open standard for machine learning int...
vendor_debian·2026·CVSS 4.7
CVE-2026-34446 [MEDIUM] CVE-2026-34446: onnx - Open Neural Network Exchange (ONNX) is an open standard for machine learning int...
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path traversal, but completely misses hardlinks because a hardlink looks exactly like a regular file on the filesystem. This issue has been patched in version 1.21.0.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-34446 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.7
CVE-2026-34446 [MEDIUM] CVE-2026-34446 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34446 :
Python vulnerability analysis and mitigation
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path traversal, but completely misses hardlinks because a hardlink looks exactly like a regular file on the filesystem. This issue has been patched in version 1.21.0.
Source : NVD
## 4.7
Score
Published April 1, 2026
Severity MEDIUM
CNA Score 4.7
Affected Technologies
Python
Wolfi
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 1.3
Exploitation Probability (EPSS) N/A
Affected packages and libraries
onnx
py3-onnx
Sources
NVD
C
Bugzilla
CVE-2026-34446 onnx: ONNX: Information disclosure through hardlink path traversal [fedora-all]
bugzilla·2026-04-02·CVSS 5.5
CVE-2026-34446 [MEDIUM] CVE-2026-34446 onnx: ONNX: Information disclosure through hardlink path traversal [fedora-all]
CVE-2026-34446 onnx: ONNX: Information disclosure through hardlink path traversal [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.
2026-04-01
Published