CVE-2026-34446
published 2026-04-01CVE-2026-34446: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the…
PriorityP426medium5.5CVSS 3.1
AVLACLPRNUIRSUCHINAN
EPSS
0.18%
7.4th percentile
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path traversal, but completely misses hardlinks because a hardlink looks exactly like a regular file on the filesystem. This issue has been patched in version 1.21.0.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | onnx | — | — |
| linuxfoundation | onnx | < 1.21.0 | 1.21.0 |
| msrc | azl3_pytorch_2.2.2-12_on_azure_linux_3.0 | — | — |
| msrc | cbl2_pytorch_2.0.0-15_on_cbl_mariner_2.0 | — | — |
| onnx | onnx | < 1.21.0 | 1.21.0 |
| onnx | onnx | >= 0 < 1.21.0 | 1.21.0 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_msrc4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-34446: (Open Neural Network Exchange (ONNX) is an open standard for machine le
osv·2026-04-02·CVSS 4.7
CVE-2026-34446 [MEDIUM] CVE-2026-34446: (Open Neural Network Exchange (ONNX) is an open standard for machine le
(Open Neural Network Exchange (ONNX) is an open standard for machine le ...)
OSV
CVE-2026-34446: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability
osv·2026-04-01·CVSS 4.7
CVE-2026-34446 [MEDIUM] CVE-2026-34446: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path traversal, but completely misses hardlinks because a hardlink looks exactly like a regular file on the filesystem. This issue has been patched in version 1.21.0.
OSV
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
osv·2026-04-01
CVE-2026-34446 [MEDIUM] ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
### Summary
The issue is in `onnx.load` — the code checks for symlinks to prevent path traversal, but completely misses hardlinks, which is the problem, since a hardlink looks exactly like a regular file on the filesystem.
### The Real Problem
The validator in `onnx/checker.cc` only calls `is_symlink()` and never checks the inode or `st_nlink`, so a hardlink walks right through every security check without any issues.
### Impact
Especially dangerous in AI supply chain scenarios like HuggingFace — a single malicious model is enough to silently steal secrets from the victim's machine without them noticing anything.
GHSA
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
ghsa·2026-04-01
CVE-2026-34446 [MEDIUM] CWE-22 ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
### Summary
The issue is in `onnx.load` — the code checks for symlinks to prevent path traversal, but completely misses hardlinks, which is the problem, since a hardlink looks exactly like a regular file on the filesystem.
### The Real Problem
The validator in `onnx/checker.cc` only calls `is_symlink()` and never checks the inode or `st_nlink`, so a hardlink walks right through every security check without any issues.
### Impact
Especially dangerous in AI supply chain scenarios like HuggingFace — a single malicious model is enough to silently steal secrets from the victim's machine without them noticing anything.
Microsoft
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
vendor_msrc·2026-04-02·CVSS 4.7
CVE-2026-34446 [MEDIUM] CWE-22 ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Red Hat
onnx: ONNX: Information disclosure through hardlink path traversal
vendor_redhat·2026-04-01·CVSS 4.7
CVE-2026-34446 [MEDIUM] CWE-41 onnx: ONNX: Information disclosure through hardlink path traversal
onnx: ONNX: Information disclosure through hardlink path traversal
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path traversal, but completely misses hardlinks because a hardlink looks exactly like a regular file on the filesystem. This issue has been patched in version 1.21.0.
A flaw was found in Open Neural Network Exchange (ONNX), an open standard for machine learning interoperability. The `onnx.load` function, which is used to load machine learning models, does not correctly handle hardlinks. This vulnerability could allow an attacker to create a specially crafted ONNX model that, when loaded by a user, could lead to the disclosure of sens
Debian
CVE-2026-34446: onnx - Open Neural Network Exchange (ONNX) is an open standard for machine learning int...
vendor_debian·2026·CVSS 4.7
CVE-2026-34446 [MEDIUM] CVE-2026-34446: onnx - Open Neural Network Exchange (ONNX) is an open standard for machine learning int...
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path traversal, but completely misses hardlinks because a hardlink looks exactly like a regular file on the filesystem. This issue has been patched in version 1.21.0.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
2026-04-01
Published